It's no secret that Java has moved to the top of the target list for many attackers. It has all the ingredients they love: ubiquity, cross-platform support and, best of all, lots of vulnerabilities. Malware targeting Java flaws has become a major problem, and new statistics show that this epidemic is following much the same pattern as malware exploiting Microsoft vulnerabilities has for years.

Security researchers and software vendors have known for a long time that attackers will wait for new patches to come out and then reverse engineer the fixes in order to find the specifics of the vulnerabilities. It’s a concern, especially for large vendors such as Microsoft, Adobe and Oracle whose software runs on hundreds of millions of machines and have regular, predictable patch cycles that attackers can depend on. This gives them a monthly or quarterly batch of fixes to sink their teeth into.

The attackers also know that many users don’t install new patches right away. Microsoft has succeeded in getting many of its customers to use automatic updates, especially in the enterprise. But there still are plenty of users, particularly consumers, who don’t take advantage of automatic updates, leaving them open to attacks. When it comes to Java, anecdotal evidence has supported the idea that even though there has been a steady stream of new vulnerabilities over the last few years, attackers have tended to focus most of their attention on older flaws for which patches already have been published.

Research from Microsoft shows that there has been a huge spike in malware targeting Java vulnerabilities since the third quarter of 2011, and much of the activity has centered on patched vulnerabilities in Java. Part of the reason for this phenomenon may be that attackers like vulnerabilities that are in multiple versions of Java, rather than just one specific version.

Jeong Wook Oh of Microsoft said,

“In Q3 and Q4 of 2012, two new vulnerabilities were found. But we didn’t observe any prevalence of Java malware abusing these newer vulnerabilities above malware abusing the older Java vulnerabilities. The reason behind this might be thatonly Java 7 installations were vulnerable to CVE-2012-4681 and CVE-2012-5076, whereas CVE-2012-0507 and CVE-2012-1723 also target Java 6. As there are still many users that use Java 6, the malware writers might have tried to target Java 6 installations by including older vulnerabilities in the exploit package. We can assume that, for this reason, they didn’t do away with the older vulnerabilities,”. 

“So there were two kinds of Java vulnerabilities that appeared in 2012 overall: One is the category that applies to both multiple versions of Java including Java 6 and 7, and the other are the vulnerabilities that only applies to Java 7. So when new vulnerabilities that are only applicable to Java 7 are discovered, the attacker’s strategy was usually to combine it with older vulnerabilities that cover more versions of Java. In that way, they could achieve more coverage than just using a single exploit in one package.”

Microsoft looked specifically at four Java vulnerabilities from 2012 that malware targeted, only one of which was a zero day. The other three flaws already had patches available when the malware targeting them appeared. This is the same kind of pattern followed by malware that targets vulnerabilities in Microsoft products and Adobe applications. It, of course, just lends more support to the advice that security experts are always giving users: Install patches as soon as they’re available. 

While many media reports will direct you to the Oracle website to promptly install the newest Java Updates and/or patches, there remains a far more secure option. Unless you’re one of the few Web users who regularly uses an important site that requires Java, take the advice of many security experts and just disable Java in your browser.  Disabling the Java plug-in on your Web browser doesn’t require uninstalling it from your machine entirely, and it won’t prevent you from Java-based software outside of your Web browser. It just means that you’ll see a "Re-enable Java" prompt when you happen to visit one of the relatively few remaining websites that use Java applets. If you find you really need it for some sites, you can always disable it in your main browser but keep it enabled in a secondary browser that you use just for those sites. 

To disable Java:

- In Firefox, select "Tools" from the main menu, then "Add-ons," then click the "Disable" button next to any Java plug-ins.    

- In Safari, click "Safari" in the main menu bar, then "Preferences," then select the "Security" tab and uncheck the button next to "Enable Java."    

- In Chrome, type or copy "Chrome://Plugins" into your browser's address bar, then click the "Disable" button below any Java plug-ins.  -   

- In Internet Explorer, There is no way to completely disable Java specifically in IE, however, uninstalling the Java platform via Control Panel will remove it completely from your system

Original Article by Dennis Fisher
View Original here

View Original Article

With the rising popularity of online cloud based apps and services, mobile device access to your files has become nearly a necessity. It’s also found almost to be the “norm” for home and business users to sync entire directories of their data with online storage accounts like Dropbox, SugarSync, Google Drive and SkyDrive.  These cloud services are an easy solution for sharing data with friends and fellow collaborators, they’re a simple automatic “offsite” backup of Documents, and they let you access your data from mobile devices or other PCs via the internet. But is all your personal data safe out there on the Internet?

It’s a known fact that Online Passwords can and have been hacked. Not to say that Password Protection isn’t safe, but passwords are vulnerable to dictionary and brute force attacks from hackers through malware and security breaches. On a number of occasions, Dropbox accounts have been exposed and compromised through these types of vulnerabilities, as well as other popular cloud service accounts. Customer and employee passwords have been stolen and used to sign into users’ accounts; which gives hackers access to all the data stored on the account. Imagine having sensitive tax documents or vital company info stolen by hackers because your cloud service company was compromised.

Not all cloud storage apps use data encryption which is something to check If you have a standalone cloud storage app installed on your computer. Data can also be captured “en route” if strong encryption is not in place. Your data isn’t always immune to search and seizure by local government entities either. In the U.S., for example, any cloud storage company could be served a subpoena requiring them to open their clients’ data for government examination or seizure .

In light of these reservations, more and more companies have started asking the question “Is there a cloud storage solution that lets me host my own data and still be able to access it from users’ mobile devices?” The answer is yes, and as time goes by, we hope to see more companies develop solutions in this growing market. There are a few companies offering this kind of solution in Private cloud storage hosting that we’ve found interesting enough to take note of.

Varonis DatAnywhere

Varonis DatAnywhere gives IT the ability to provide an alternative to cloud-based file sharing solutions and at a fraction of the cost of shipping data to the cloud. Your corporate infrastructure is managed and protected according to your corporate policies and fits your data governance workflow. DatAnywhere lets you instantly transform your corporate infrastructure into a secure cloud-like file synchronization platform. DatAnywhere lets you Create a secure private cloud experience using your existing file sharing Infrastructure while keeping the data on your own file servers.  Your existing NTFS File/Folder permissions are synchronized with Active directory. Secure, enterprise-capable file synchronization and mobile device access is included in the DatAnywhere Service. Definitive copies are always stored on corporate storage and you are able to control speed, availability, and security of your own hosted data.

Varonis DatAnywhere translates legacy LAN protocols (CIFS) into a secure, weboptimized protocol (HTTPS) via a dynamic, scalable data-routing infrastructure that facilitates https access and block-level syncing with remote devices. All DatAnywhere components reside within your corporate network and run on standard servers — DatAnywhere components can be installed on a single virtual node for small environments, or be distributed to scale to an enterprise with many file servers/NAS devices in many locations.

Novell FilR.

Novell Filr provides enterprise-level mobile file access and sharing. Novell Filr allows your users to access their home directories and network folders on any mobile device, as well as synchronize their files to their PC and Mac computers. They can also share the files internally and externally and comment on shared files. Rather than move your data to the cloud, Filr lets you keep files and data where they are today and where they belong—in established and secure company file storage that already meets your regulatory requirements; your own file servers.

IT doesn’t have to provision new storage for Filr users. It’s already there; configured n Active Directory. The backup and security systems that IT has built (and you’ve invested in) continue to protect your data on Filr. Filr fits nicely into both Windows Server and Novell Open Enterprise Server environments. IT can control file access and sharing so public material can spread while intellectual property stays put.

Spamhaus supplies lists of IP addresses for servers and computers on the net linked to the distribution of spam. The blacklists supplied by the not-for-profit organization are used by ISPs, large corporations and spam filtering vendors to block the worst sources of junk mail before other spam filtering measures are brought into play.

Spammers, of course, hate this practice so it’s no big surprise that Spamhaus gets threatened, sued, and attacked regularly. The latest run of attacks began on 18 March with a 10Gbps packet flood that saturated Spamhaus’ connection to the rest of the Internet and knocked its site offline. Spamhaus’s blocklists are distributed via DNS and widely mirrored in order to ensure that it is resilient to attacks. The website, however, was unreachable and the blacklists weren’t getting updated.

The largest source of attack traffic against Spamhaus came from DNS reflection, launched through Open DNS resolvers rather than directly via compromised networks. Spamhaus turned to CloudFlare for help and the content delivery firm was able to mitigate attacks that reached a peak of 75Gbps.

Things remained calm for a few days before kicking off again with even greater intensity – to the extent that collateral damage was seen against services such as Netflix. Spamhaus’ site remains available at the time of writing on Wednesday. Steve Linford, chief executive for Spamhaus, told the BBC that the scale of the attack was unprecedented.

A blog post by CloudFlare, written last week before the latest run of attacks, explains the mechanism of the attack against Spamhaus and how it can be usedto amplify packet floods.

The basic technique of a DNS reflection attack is to send a request for a large DNS zone file with the source IP address spoofed to be the intended victim to a large number of open DNS resolvers. The resolvers then respond to the request, sending the large DNS zone answer to the intended victim. The attackers’ requests themselves are only a fraction of the size of the responses, meaning the attacker can effectively amplify their attack to many times the size of the bandwidth resources they themselves control.

In the Spamhaus case, the attacker was sending requests for the DNS zone file for ripe.net to open DNS resolvers. The attacker spoofed the CloudFlare IPs we’d issued for Spamhaus as the source in their DNS requests. The open resolvers responded with DNS zone file, generating collectively approximately 75Gbps of attack traffic. The requests were likely approximately 36 bytes long (e.g. dig ANY ripe.net @X.X.X.X +edns=0 +bufsize=4096, where X.X.X.X is replaced with the IP address of an open DNS resolver) and the response was approximately 3,000 bytes, translating to a 100x amplification factor.

 

Even the most savvy information technologists aren't immune from cyber-attacks. Just ask Facebook. The social-media titan says it fell victim to a sophisticated attack discovered in January in which an exploit allowed malware to be installed on employees' laptops.

In a blog posted by Facebook Security on Feb. 15, the company said it found no evidence that Facebook user data was compromised.

Here's what happened at Facebook, according to its blog:

Several Facebook employees visited a mobile developer website that was compromised. The compromised website hosted an exploit that then allowed malware to be installed on these employees' laptops.

"The laptops were fully-patched and running up-to-date anti-virus software," the blog says. "As soon as we discovered the presence of the malware, we remediated all infected machines, informed law enforcement and began a significant investigation that continues to this day."

Facebook Security flagged a suspicious domain in its corporate DNS (Domain Name Servers) logs and tracked it back to an employee laptop. The security team conducted a forensic examination of that laptop and identified a malicious file, and then searched company-wide and flagged several other compromised employee laptops.

After analyzing the compromised website where the attack originated, Facebook found the site was using a previously unseen, zero-day exploit to bypass the Java sandbox (built-in protections) to install the malware. Facebook immediately reported the exploit to Oracle, and Oracle confirmed Facebook's findings and provided a patch on Feb. 1 that addressed the vulnerability.

Facebook says it wasn't the only victim of this exploit. "It is clear that others were attacked and infiltrated recently as well," the blog says. "As one of the first companies to discover this malware, we immediately took steps to start sharing details about the infiltration with the other companies and entities that were affected. We plan to continue collaborating on this incident through an informal working group and other means."

The social-media company says it is working with law enforcement and the other organizations affected by this attack. "It is in everyone's interests for our industry to work together to prevent attacks such as these in the future," Facebook says.

Sharing threat information has received much attention in Washington this past week. President Obama, in his State of the Union address on Feb. 12, announced an executive order that calls on the government to share cyberthreat information with critical infrastructure owners and called for legislation to allow businesses to share threat information with the government and with each other [see Obama Issues Cybersecurity Executive Order]. The following day, the heads of the House Permanent Select Committee on Intelligence introduced a bill to do just that [see Is Compromise in Offing for CISPA?] .

Facebook is the latest high-profiled media company to reveal it's been victimized by intruders. The New York Times, Wall Street Journal, Twitter and Washington Post have reported their websites being attacked [see N.Y. Times' Transparent Hack Response and Twitter, Washington Post Report Cyberattacks].

The Facebook attack is reminiscent of the 2011 breach at security provider RSA, when a well-crafted e-mail tricked an RSA employee to retrieve from a junk-mail folder and open a message containing a virus that led to a sophisticated attack on the company's information systems [see 'Tricked' RSA Worker Opened Backdoor to APT Attack].

Original Article By Eric Chabrow

View Original Article Here

View Original Article

A pre-release version ( The Office 2013 Release Preview ) is currently available for free on Microsoft’s website. You can download and install Office 2013 for free using the following method:

• Visit www.microsoft.com/office/preview/
• Log in with a valid Microsoft Account (formerly called Windows Live ID). If you don’t have one, the site walks you through steps in setting one up.
• Download the install files and run the Office2013ConsPrev.exe install program. Make sure, beforehand, that you have the following Office 2013 system requirements.
• Computer and processor: 1 GHz or greater x86/x64 Processor with SSE2 instruction set
• Memory: 1 GB RAM (32-bit) / 2 GB RAM (64-bit)
• Hard disk: 3.5 GB free disk space
• Operating System: Windows 7, Windows 8, Windows Server 2008 R2 or newer
• Graphics: Graphics hardware acceleration requires DirectX10 graphics card and 1024×576 resolution

This new version of office does have the “backbone” of Office 2010, but there are a few additions that are worth mentioning. Here’s a little of what to expect:

New Interface designed for Touch devices: Gone are the multiple color shades that decorated the older interface’s menu bars, as well as the “3D looking” shadow and shading effects. Instead, everything looks minimalist, flat, and stark—mimicking the tiles on the Windows 8 “Metro Style” start screen. Its optimized for pen and touch as well as keyboard and mouse, making common tasks fast, fluid, and intuitive. Each application also comes with a new start screen interface that auto-populates recently opened documents and directories; leaving a few less steps for locating and opening office files.

Edit PDF documents in Word 2013:One of the handiest features in Word 2013 is that it can now open and edit PDF files. Word 2013 has long been able to save into PDF format, but the ability to edit PDF files is a welcome addition to its arsenal. The “re flow” feature will recognize most headings and other formatting features; making it quite helpful if you get sent a PDF you need to re-purpose and don’t want to mess with Adobe Acrobat (or pay for it). You can open PDF files in Word, and its paragraphs, lists, tables, and other content act just like Word content.  You can make and save changes to the file as per your requirements and easily export them back as a PDF document.

Faster Data Entry in Excel: Flash fill, a new tool in Excel, makes data entry faster. As soon as it detects what you want to do, flash fill enters the rest of your data in one fell swoop, following the pattern it recognizes in your data.

Cloud Computing with built in SkyDrive Integration: Office 2013 is designed to integrate with Microsoft’s cloud computing apps, SkyDrive and SharePoint. This lets you save your work online for anywhere-access, though most small businesses and individuals still save files locally. If you use SkyDrive, the account details wil appear in the top left corner of all the application screens, as well as on their start screens. Click your account details to switch accounts and to manage them. When you save a document, worksheet, or presentation, the application will default to saving to your SkyDrive account, but you can save to your local disk if you wish.

Zorin OS (now on version 6) is an Ubuntu-based Linux distribution that bills itself as “the gateway to Linux for Windows users.” Zorin OS 6 comes closer to re-creating the Windows experience than any other Linux distrobution by using Ubuntu as its core, and coating it with a decidedly Windows-like interface. This means you get the things you’re used to, like the Start button in the lower-left corner of the screen, and a programs list and search tool that pops up when you click it. In the lower-right corner there’s a notification area, clock, volume control, etc. These and other familiar trappings make it easier for Windows users to make the transition. Zorin is, by no means, an exact Windows 7 replica, but it does a pretty good job re-creating the look and feel of its interface.

Customization

You can use the Zorin Look Changer to choose from a variety of other interface emulations, including Windows XP, Mac OS X, and the Linux-standard GNOME 2. These setting will offer the look and feel of different OS interfaces you’re already used to.  Easily add shortcuts to programs by “pinning” them to the taskbar or start menu. Add a “Mac-like” dock on the lower or left hand side of the desktop for easy application launching. Essentially, Zorin gives you the option to pick which OS you’re most comfortable with including the added bonus of not having to “re-learn your way around” your PC.

Security

One of the main advantages of using a Linux based OS like Zorin is its security. People who have been affected by malware attacks share the constant concern of being infected by another debilitating virus while surfing the web or opening links from emails. Since Zorin is built from Linux, it carries immunity to all Windows viruses and malware, which make up the overwhelming majority of The Market Share. This gives the user freedom to surf the web without the fear that a suspicious or compromised website may have leaked malware into their computer. This feature alone is an ideal solution and a great reason to consider switching from a Windows OS for any user prone to contracting viruses.  Zorin OS also comes with integrated firewall software that updates on the hour.

Compatibility

The OS comes with a ton of useful software, including Google’s Chrome browser, LibreOffice, Thunderbird, and GIMP. You also get PlayOnLinux, which allows you to install and run a wide variety of Windows programs (including iTunes). PlayOnLinux uses Wine to install compatable Windows applications and games on Linux based Operating Systems. Though using WIne to run Windows software on Linux has proven not to be for novice users in the past, PlayOnLinux creates a slightly more user-friendly graphical interface for running/installing Windows Software. Not all Windows apps will work in Wine, but with a little bit of online research, you can find out wether or not your Windows software is compatable.

Nearly every file that you’d need to open with your Windows operating system will work perfectly in Zorin OS with no need for additional setup. All your ms office documents, music, videos, pictures etc. will work out of the box.  Zorin OS also supports a large library of devices such as printers, scanners, cameras, keyboards. These devices will work as soon as you plug them in without the need for installing additional drivers.

Remote access to and from Zorin machines can be contucted through third party applications as well. Teamviewer is a popular application that works with most Operating Systems without having to use or install Remote Desktop Clients or work in virtual environments. Teamviewer offers a free Linux compatable download on their website: http://www.teamviewer.com/en/download/linux.aspx

GoDaddy has issued a short statement on Twitter, but has not yet given a reason for the outage.

“Status Alert: Hey, all. We’re aware of the trouble people are having with our site. We’re working on it,” the alert stated.

Users started noticing the troubles in the late morning Eastern Time. Customers with GoDaddy-hosted email accounts and websites noticed the outage, as did at least some users who had registered their domain names with GoDaddy, even though their sites are actually hosted elsewhere. When pinged, websites registered with GoDaddy receive only a “ping request could not find host,” message. The GoDaddy.com site itself went offline.

The reaction across the Internet has been immediate and caustic. “Hi @godaddy. Like everybody else hosted by you, our website is down. Please fix now thanksabunch bye,” a Twitter message from CouponPuppet.com read.

GoDaddy claims to be the world’s largest domain name registrar. The company reportedly manages more than 48 million domain names and serves more than 9.3 million customers.

The complete original file also contains user names, name of device, type of device, APNS tokens, ZIP codes, mobile phone numbers, addresses, and more. AntiSec’s release doesn’t include this personal information and the hacker group says it only wants the public to know that the FBI uses such information to spy on people.

Apple says it never gave the FBI any such information while the bureau itself issued a statement denying the data came from them. "The FBI is aware of published reports alleging that an FBI laptop was compromised and private data regarding Apple UDIDs was exposed. At this time, there is no evidence indicating that an FBI laptop was compromised or that the FBI either sought or obtained this data," it says, in a remarkably short and vague answer to a controversy of this magnitude.

Still, the UDIDs are real—many news outlets are publishing examples of people who have found their devices on the list.

Where did the List Come From?

An Apple spokesperson told the web site AllThingsD that “The FBI has not requested this information from Apple, nor have we provided it to the FBI or any organization. Additionally, with iOS 6 we introduced a new set of APIs meant to replace the use of the UDID and will soon be banning the use of UDID.”

If that’s true and assuming the list wasn’t gleaned from some kind of hack into Apple or other company, the next most likely culprit is an app developer. Here’s why:

The UDID is an alpha-numeric string of characters that tells Apple and developers which device is yours so they can do things like push alerts to your phone, serve you ads and keep track of your preferences. Following privacy concerns Apple has cracked down on developers that track users via the UDID because it found that in addition to the identifier some developers were also garnering personal user data. That means any number of developers with more than 12 million users could have compiled the data the FBI agent supposedly had on his laptop.

Another clue the list is app-related was tweeted by AnonymousIRC (AntiSec is a subset of the loose hacking collective called Anonymous) and shown here.

Lots of people are trying to figure out which ones might be suspect. For instance, anyone who finds their device on AntiSec’s list can now help solve the mystery by completing an online survey that seeks to determine which apps are common to those listed.

Is Your Device on the List?

First, you need to determine the UDID of your Apple device. You can do that by connecting it to iTunes. From there, click on your device's name in the left-hand column and on the right you'll see system data, including your serial number. Click on it to show your UDID.

Alternately, you can use an app to figure it out. Just go to the iTunes Store and search for “UDID.” A slew of options are available for download.

The Next Web has posted a UDID checker. You can use a Web proxy like Anonymouse.org or HideMyAss.com to mask your identity from the site. Of course your ID could be one of the 11 million that hasn't been released, so it would only confirm that you are on the list.

Who’s Lying?

While it’s always risky to trust anything a hacker says, another expletive-ridden statement surfaced today supposedly from AntiSec that gives some cryptic clues to authenticate what it says it found on the FBI agent’s laptop. According to the post, the group is being careful with what information it releases because, basically, it doesn’t want to get caught. In the message, the person said more information will be forthcoming but it will be on the group’s timeline and no one else’s.

But the FBI’s denial leaves a lot to the imagination in terms of brevity and vagueness. Doesn’t it sort of sound like they’re saying “Prove it”? And even if any such stolen data didn’t technically come from an FBI-owned laptop, couldn’t it have been stored on an agent’s personal machine?

Why Would the FBI Want This Information?

That’s the most interesting question of all.

One security researcher pointed out to The New York Times that the F.B.I. could have received the file as part of a forensics investigation involving a separate data breach.

Then again, there is plenty of evidence the government wants to track people.

For example, legislation has been drafted by Congress that would make it easier for the government to spy on people. CISPA has already been passed in the House of Representatives and its Senate counterpart, SECURE IT, is in committee. While these bills aim to protect the U.S. from cyberterrorism, they also would allow companies to share user’s private data with the government without a warrant or any oversight.

There’s also a landmark case in which the Supreme Court in January ruled unanimously that police and the FBI violated the Fourth Amendment when they secretly attached a GPS tracker to a man’s car and tracked him for a month.

“But now the government — instead of fixing the way it conducts this kind of invasive surveillance — has simply set its sights on another way to obtain people's location information: their cell phones,” writes the ACLU in a statement.

The defendant is being retried and last week his attorney said that prosecutors have also obtained records showing the location and movement of his cell phone over the course of five months.

“Since the GPS data from Jones's car was thrown out by the Supreme Court, it seems the prosecution intends to use Jones's cell phone data to get another bite at the apple. Like the GPS device on the car, the government was able to obtain the cell phone information without a probable cause warrant. Instead, it only had to claim that the data was ‘relevant and material’ to an ongoing investigation,” the ACLU points out, adding that after investigating public records the civil liberties watchdog group found that hundreds of law enforcement agencies engage in cell phone tracking on a regular basis, many of which do so without a warrant.

The ACLU says pending legislation in Congress, titled the Geolocation Privacy and Surveillance (GPS) Act, would require law enforcement agents to obtain a warrant in order to access location information.

Want to support it? The ACLU has a slick tool on its site that will send a message to your legislators. 

Original Article by Christina DesMarais

View Original Article

In an explanatory blog post, Dropbox today said a stolen password was "used to access an employee Dropbox account containing a project document with user email addresses." Hackers apparently started spamming those addresses, although there’s no indication that user passwords were revealed as well. Some Dropbox customer accounts were hacked too, but this was apparently an unrelated matter. "Our investigation found that usernames and passwords recently stolen from other websites were used to sign in to a small number of Dropbox accounts," the company said.

Dropbox noted that users should set up different passwords for different sites. The site is also upping its own security measures. In a few weeks, Dropbox said it will start offering an optional two-factor authentication service. This could involve users logging in with a password as well as a temporary code sent to their phones.

Dropbox has also set up a new page letting users view all the active logins to their accounts, and said it is planning "new automated mechanisms to help identify suspicious activity." At any rate, users may want to think about examining more secure alternatives, encrypting their files, or simply not storing ultra-sensitive information in Dropbox. You may recall that one year ago, a Dropbox screwup left all user accounts unsecured and accessible with any password for four hours. These mistakes haven't led to major problems for users that we know of just yet, but they don't inspire much confidence in Dropbox's security systems.

Jon Brodkin / Jon is Ars Technica's senior IT reporter, covering the latest in business technology and the intersection of consumer technology and IT. He also writes about technology policy, patent litigation, supercomputing, and wireless technology.

View Original Article

July 20, 2012 10:27 AM PDT

Start8 brings back the Start button in Windows 8 and can automatically load the desktop after logging in.

(Credit: Screenshot by Ed Rhee/CNET)

The Metro start screen in Windows 8 has been a polarizing change from Windows 7, to put it mildly. If you click the desktop tile immediately after logging in, a free program by Stardock can save you some time. With Start8, you can automatically load the desktop after logging in to Windows 8. Start8 will even add back the Windows Start button.

To use Start8 to bypass the Metro start screen, go to Stardock's Web site and sign up with your e-mail address to get the download link.

Once you've installed Start8, right-click on the Start button from the Windows 8 desktop, then select "On login go to the desktop."

(Credit: Screenshot by Ed Rhee/CNET)

That's it. The next time you log in to Windows 8, you'll be taken straight to the desktop. If you need to view the Metro start screen, select "Show Fullscreen Metro Start Menu" to display it when you click the Start button or hit the Windows key. Keep in mind that Start8 is currently beta software, so the usual caveats apply.

View Original Article