A serious flaw that allows for drive-by-download attacks picks up a patch in today's regular monthly patch batch from Redmond, as do critial flaws in Microsoft Office. Network attack vectors of most concern for business networks get shored up as well.
The most important patch, MS09-065, closes a hole that could allow an attacker to take control of a vulnerable system if you view a specially crafted Embedded OpenType font. The patch is rated critical for Windows 2000, XP and Server 2003, and important for Vista and Server 2008.
According to nCircle, an enterprise security auditing company, an attack could be triggered by viewing either a malicious Web site or opening a poisoned Office document. And Symantec says that proof-of-concept code is already publicly available, so this is the patch to get.
The other two critical patches this month shore up network-based risks of most concern to businesses. The first involves the Web Services on Devices Application Programming Interface (WSDAPI) and is rated critical for Vista and Server 2008. Per Microsoft, a specially crafted packet sent across the network could trigger the flaw, but the attacker would have to be on the same local subnet. See MS09-063 for more details.
The final critical patch is rated critical for Windows 2000 systems running the License Logging Server. A vulnerable system could be compromised by a "specially crafted network message," but unlike the WSDAPI flaw, an attack against this hole wouldn't have to be launched from the same local subnet. MS09-064 has more info.
Office picks up a couple of patches as well, which are only rated important by Microsoft but could still allow for remote code execution, ie. taking over a vulnerable computer, if you open a malicious Word or Excel file. Per Microsoft, both these flaws are rated important rather than critical because "Microsoft Office Excel [or Word] 2002 and later versions have a built-in feature that prompts a user to Open, Save, or Cancel before opening a document. This mitigating factor reduces the vulnerability from Critical to Important because the vulnerability requires more than a single user action to complete the exploit."
The Excel patch, MS09-067, is for Office XP, 2003 and 2007, along with Office 2004 and 2008 for Mac. The Open XML File Format Converter for Mac also needs the fix, as does the Office Excel Viewer 2003 and the Office Excel Viewer Service Office Compatibility Pack for Word, Excel and PowerPoint 2007 File Formats.
Pick up the Word patch, MS09-068, for Office XP and Office 2003, as well as Office 2004 and 2008 for Mac, the Open XML File Format Converter for Mac, the Office Word Viewer 2003 and the Office Word Viewer.
The last important-rated patch closes a denial-of-service security hole in the Active Directory directory service, the Active Directory Application Mode (ADAM), and the Active Directory Lightweight Directory Service (AD LDS). MS090-066 is for Windows 2000, XP, Server 2003 and Server 2008, and per Microsoft is only required for domain controllers and systems configured to run ADAM or AD LDS.
“The sweet spot.” It sounds like that’s going to be VR’s new focus, as we head into Oculus Connect’s fourth annual iteration. And what is that sweet spot, exactly? Not mobile VR, not PC-based VR, but a blend of both. No wires, but the same high-fidelity experience people get from the Oculus Rift.
That’s still probably a ways off, but Oculus took its first steps in that direction at Connect, announcing its new $199 Oculus Go headset, plus giving us our first look of the upcoming “Santa Cruz” prototype with inside-out position tracking.
Oculus Go is pretty easy to explain: Imagine Samsung’s Oculus-based Gear VR headset, but without needing a separate phone to power the experience. That’s it, really.
And really that’s all Oculus needed. The $99 Gear VR is a great piece of hardware, but its audience was always limited by the pool of people who own a compatible Samsung Galaxy phone. Oculus Go broadens that audience significantly, and at $199 it’s set to be one of the cheapest VR headsets on the market when it releases in early 2018—and without wires tethering you to the PC.
Oculus Go also includes built-in audio, which is a definite improvement over Samsung Go. It’s not the same oversized on-ear headphones found on the core Oculus Rift, but there is support for spatial audio and the speakers look like they’re built into the headband. I’ve come to depend on built-in audio for VR—its convenience trumps the fidelity (but added clumsiness) of separate headphones.
Now, whether the experience will be as good as PC-centric VR? No way. The display is a bit better, coming in at 2560x1440 compared with the Oculus Rift’s 2160x1200, but this is still mobile VR at heart. Oculus even rammed that point home, announcing that Gear VR apps will be compatible with Oculus Go, using the same control schemes.
It’s also worth noting that Oculus Go doesn’t include position-tracking for either the headset or controllers—like Gear VR, this is head-tracking only. That means no room-scale, nor even the pseudo-room scale/standing experience you can get with the basic Oculus Rift + Touch package.
As I said, it’s a Gear VR without the need for an added phone. That’s definitely a good play for broadening VR’s audience, but we’re still talking entry-level.
Then there’s Santa Cruz, which Oculus has deemed “the future” of Rift. Santa Cruz is the promised land, essentially—a standalone headset with the power of the Rift (or at least the Rift tethered to a low-end PC) and inside-out position tracking. It’s sort of like a blend of the Rift, Gear VR, and Microsoft’s upcoming slate of Windows Mixed Reality headsets.
First, some bookkeeping: Santa Cruz is still very much in the prototype phase, with dev kits sets to go out sometime next year. That’s about all we know though. Expect a full launch in late 2018 or even 2019 at the earliest.
Aside from being wire-free, Santa Cruz does make some improvements over similar systems—particularly Microsoft’s headsets. When I checked out Dell’s upcoming Windows Mixed Reality headset, I noted that hand tracking was particularly buggy. By using only two cameras, Microsoft’s headsets lose track of your hands any time they’re out of your immediate central vision.
Santa Cruz uses four cameras, not two, and places them around the perimeter of the headset. Tracking is still concentrated in front of you, so this is certainly not as seamless as a base station system used by the Oculus Rift or the HTC Vive. Santa Cruz does track your hands when you reach up above your head though, for instance, as well as out to the sides a bit.
It’s hard to say how much you’ll notice the moments it doesn’t track—after all, your hands would be almost behind you at that point. We’ll need to get some hands-on time with the unit to test that functionality. Hopefully we can do that here at Connect today, though we’re not sure yet whether those prototypes are here on the show floor or not.
Oculus also redesigned its Touch controllers to work with Santa Cruz, which might help. The large ring that used to go over your knuckles now protrudes above the thumb, presumably to aid tracking as you move your hands out to the sides or down to your waist. The new controllers also add a touchpad, a la the Vive—no surprise there.
Santa Cruz looks promising, at least on paper, though we haven’t gotten any word on specs, lenses, or any of the hardware central to making a PC-quality experience in a mobile form factor. We’ll update you as soon as we know more.
And that’s it. No, really. If you were hoping for a refresh of the tethered Oculus Rift, well, you’re going to be waiting a while longer. Hell, with Santa Cruz on the horizon and Facebook’s “1 billion people in VR” pursuit, we might never see another high-priced and PC-centric VR headset from them again.
On the plus side, Oculus Rift got a permanent price drop today. Yes, another. It’s now going to be sold for the special $399 price Oculus tested out in its Summer of Rift promotion this year. Sounds like that price did great for Oculus—the HTC Vive is still $599, which is a huge anchor around their neck at this point.
That’s it for Oculus Connect 4’s hardware news. Stay tuned however—we’ll be here all day checking out demos of both hardware and software, and will update if there’s anything particularly revolutionary.