Read more of this story at Slashdot.
Feeds
34717 items (30204 unread) in 5 feeds
OpenSource
(5765 unread)
-
SourceForge.net: Front page news
(802 unread)
-
Slashdot: IT (4963 unread)
Security
(11361 unread)
-
Digg / Security (11361 unread)
Linux
(13078 unread)
-
-
Slashdot: Linux (1660 unread)
Slashdot: IT (104 unread)
-
Toyota Pedal Issue Highlights Move To Electronics
Posted: January 31st, 2010, 9:20pm CET by timothy
Tags: transportation
cyclocommuter writes with an excerpt from a brief WSJ story on increasing electronic control of car components: "The gas pedal system used Toyota Motor Co.'s recall crisis was born from a movement in the auto industry to rely more on electronics to carry out a vehicle's most critical functions. The intricacy of such systems, which replace hoses and hydraulic fluid with computer chips and electrical sensors, has been a focus as Toyota struggled to find the cause for sudden acceleration of vehicles that led the company to halt sales of eight models this week." -
UK Gov't Says "No Evidence" IE Is Less Secure
Posted: January 31st, 2010, 12:00pm CET by timothy
Tags: msie
aliebrah writes "Lord Avebury tabled a parliamentary question in the UK regarding the security of Internet Explorer and whether the UK government would reconsider its use. He got an answer from the UK Home Office that's unlikely to please most Slashdot readers. The UK government contends that 'there is no evidence that moving from the latest fully patched versions of Internet Explorer to other browsers will make users more secure.'"Read more of this story at Slashdot.
-
Solutions For More Community At Work?
Posted: January 31st, 2010, 12:24am CET by timothy
Tags: communications
CrunkCreeper writes "I work at a tier-2 hosting company (SAP, web servers, Citrix, databases, etc.). I started working at this location two years ago in January. The company had anywhere from 20-30 other employees, and now we are just over 100. People with all different IT experience are employed. At one end of the spectrum, you have accounting, billing, and sales. At the other end you have the help desk, analysts, and engineers. In the past we were hiring mainly people in their 20s, and now we're hiring more senior people in their 30s and 40s. Incidentally with our expanded demographic and recently aggressive hiring, people are not as familiar with each other as they used to be. This happens to some extent and will continue to happen more the larger our company grows, but I would like to curb the corporate feel a bit. I'm trying to bring family or community feel back to the company. The reason for this need is that great ideas are normally discussed in non-formal environments. Beside this fact, I want people to genuinely have more fun and decrease the sometimes uncomfortable discussions with 'that guy' from 'that department.' Being an IT company, I find it more natural for collaboration via computer, but welcome more traditional methods too. How does your company keep or build a community environment using technology?" Read on for some more on how it works at CrunkCreeper's workplace, and give suggestions for how to make things better.Read more of this story at Slashdot.
-
Gun With Wireless Arming Signal Goes On Sale Soon
Posted: January 30th, 2010, 2:02pm CET by timothy
Tags: security
An anonymous reader writes "Armatix has built a pistol that will disarm itself when it is taken away from a watch that sends it a wireless arming signal. The .22 caliber guns will go on sale in the US within months, and the initial price is 7,000 euro. Higher caliber models will follow. To activate the gun, users must enter a pin code on the wristwatch, and then keep it within roughly 20cm of the gun. If the person is disarmed, the gun can't be used against them. Also coming soon this year, civilians will also be able to buy three-shot Tasers, rubber bullets, as well as Heckler and Koch black rifles." This might not be good news for the citizens of New Jersey.Read more of this story at Slashdot.
-
Google To Pay $500 For Bugs Found In Chromium
Posted: January 29th, 2010, 9:41pm CET by ScuttleMonkey
Tags: google
Trailrunner7 writes to mention that a new program from Google could pay security researchers $500 for every security bug found in Chromium. Of course if you find a particularly clever bug you could be eligible for a $1337 reward. "Today, we are introducing an experimental new incentive for external researchers to participate. We will be rewarding select interesting and original vulnerabilities reported to us by the security research community. For existing contributors to Chromium security — who would likely continue to contribute regardless — this may be seen as a token of our appreciation. In addition, we are hoping that the introduction of this program will encourage new individuals to participate in Chromium security. The more people involved in scrutinizing Chromium's code and behavior, the more secure our millions of users will be. Such a concept is not new; we'd like to give serious kudos to the folks at Mozilla for their long-running and successful vulnerability reward program."Read more of this story at Slashdot.
-
Parallel Algorithm Leads To Crypto Breakthrough
Posted: January 29th, 2010, 2:18pm CET by timothy
Tags: encryption
Hugh Pickens writes "Dr. Dobbs reports that a cracking algorithm using brute force methods can analyze the entire DES 56-bit keyspace with a throughput of over 280 billion keys per second, the highest-known benchmark speeds for 56-bit DES decryption and can accomplish a key recovery that would take years to perform on a PC, even with GPU acceleration, in less than three days using a single, hardware-accelerated server with a cluster of 176 FPGAs. The massively parallel algorithm iteratively decrypts fixed-size blocks of data to find keys that decrypt into ASCII numbers. Candidate keys that are found in this way can then be more thoroughly tested to determine which candidate key is correct." Update by timothy, 2010-01-29 19:05 GMT: Reader Stefan Baumgart writes to point out prior brute-force methods using reprogrammable chips, including Copacobana (PDF), have achieved even shorter cracking times for DES-56. See also this 2005 book review of Brute Force, about the EFF's distributed DES-breaking effort that succeeded in 1997 in cracking a DES-encrypted message.Read more of this story at Slashdot.
-
80% of Cell Phone Encryption Solutions Insecure
Posted: January 29th, 2010, 12:21am CET by timothy
Tags: encryption
An anonymous reader writes "Mobile Magazine writes about a blogger named Notrax who has tested 15 methods of secure encryption for mobile phones; out of those he found only 3 could not be cracked at some level. '12 of them were "worthless." It's easy to take the software at face value when it "tells you" that the call is secured. But how does someone actually go about being sure that it is secured? Notrax did some digging and discovered he could break in to almost all of them in under 30 minutes.'" (Above link is to a slightly older description of Notrax's approach; then, it was 9 out of 10 products that were worthless, instead of 12 out of 15.)Read more of this story at Slashdot.
-
Why "Verified By Visa" System Is Insecure
Posted: January 28th, 2010, 8:31pm CET by timothy
Tags: security
angry tapir writes "A widely deployed system intended to reduce on-line payment card fraud is fraught with security problems, according to University of Cambridge researchers. The system is called 3-D Secure (3DS) but is better known under the names Verified by Visa and MasterCard SecureCode. Steven J. Murdoch, a security researcher at the University of Cambridge, and security engineering professor Ross Anderson contend there are several flaws with 3DS. One of their main points is how 3DS is integrated into Web sites during a transaction — e-Commerce Web sites display 3DS in an iframe."Read more of this story at Slashdot.
-
Interview With a Convicted 419 Scammer
Posted: January 28th, 2010, 6:23pm CET by CmdrTaco
Tags: security
An anonymous reader writes "Scam awareness website www.scam-detectives.co.uk has published a two part interview with convicted Nigerian 419 scammer, 'John.' 'John' talks about his experiences of scam victims, how he gains their trust and convinces them to part with their money, and how he would go back for another 'bite' after the original scam, posing as a law enforcement official who has apprehended the scammer and recovered the funds ... for a fee, of course."Read more of this story at Slashdot.
-
Meet the Military's Cyber-Security Forces
Posted: January 28th, 2010, 5:41pm CET by CmdrTaco
Tags: government
destinyland writes "How exactly would the military fight a cyber war? In August 2009, the U.S. Air Force activated its new cyberspace combat unit, the 24th Air Force, to 'provide combat-ready forces trained and equipped to conduct sustained cyber operations.' It's commanded by former Minuteman missile and satellite-jamming specialist Major General Richard Webber. (And under his command are two wings, the 688th Information Operations Wing and the 67th Network Warfare Wing, plus a combat communications units.) Meanwhile, to counter the threat of cyber warfare, DARPA is still deploying the National Cyber Range, a test bed of networked computers to test countermeasures against 'cyberwar.' (According to one report, it provides 'a virtual network world — to be populated by mirror computers and inhabited by myriad software sim-people "replicants," and used as a firing range in which to develop the art of cyber warfare.') The Obama administration has even added a military cybersecurity coordinator to the National Security team."Read more of this story at Slashdot.
-
Behind Google's Recent Decision About China
Posted: January 28th, 2010, 2:45pm CET by CmdrTaco
Tags: censorship
yuhong writes "This article by The Independent takes a look at what is behind the recent decisions made by Google regarding China, particularly regarding Sergey Brin, born in the USSR, [and whose origins] played a big part in this decision. From the article: 'He's always had an emotional tug within him, saying "we shouldn't be making compromises," says Ken Auletta, the author of Googled: The End of the World As We Know It.'"Read more of this story at Slashdot.
-
Antarctica Needs a Network Engineer
Posted: January 27th, 2010, 3:40pm CET by CmdrTaco
Tags: IT
littlekorea writes "It's a little underpaid, but network engineers with a fetish for very cold weather might be interested to know that the Australian Government's Antarctic Division is seeking network engineers to manage its telephony, satellite and radio comms in Antarctica. According to the job FAQ, summer temperatures aren't a lot colder than your average data centre. But winters of -30 degrees celsius (-22 Fahrenheit) might make the morning jog a little challenging."Read more of this story at Slashdot.
-
BSkyB Wins £709m Lawsuit Against HP-EDS
Posted: January 26th, 2010, 11:38pm CET by kdawson
Tags: court
E5Rebel writes "In a massive legal case in the UK, HP-EDS has been found guilty of 'fraudulent misrepresentation' by their sales team when winning a major CRM project. Settlement could cost £200M out of an initial claim for £700M. HP's only relief was that parts of the claim were dismissed, but the core claim was upheld. HP is likely to appeal. Outsourcing will never be the same again. HP workers have been on strike against pay cuts last week; no doubt management will try and screw them further to pay for this debacle."Read more of this story at Slashdot.
-
CompTIA Reneges, Reconsiders on Lifetime Certifications
Posted: January 26th, 2010, 8:41pm CET by kdawson
Tags: Education
garg0yle writes "Recently, it was reported that IT certification house CompTIA had changed their A+, Network+, and Security+ certifications — rather than being 'for life,' there would now be a recertification requirement through continuing-education credits (and an accompanying fee). Needless to say, this made a lot of people very unhappy, and today it was announced that CompTIA has reversed their decision. Basically, any certification obtained before 2011 will still be 'for life.'" Ars notes the coincidence that CompTIA contacted them about the change of heart an hour after Ars's story about CompTIA's initial switcheroo went live.Read more of this story at Slashdot.
-
Evidence Weakens That China Did the Recent Cyberattacks
Posted: January 26th, 2010, 7:57pm CET by kdawson
Tags: government
click2005 notes an article in The Register calling into question the one piece of hard evidence that has been put forward to pin the Google cyberattacks on China. It was claimed that a CRC algorithm found in the Aurora attack code was particular to Chinese-language developers. Now evidence emerges that this algorithm has been widely known for years and used in English-language books and websites. Wired has a post introducing the Pentagon's recently initiated effort to identify the "digital DNA" of hackers and/or their tools; this program is part of a wide-ranging effort by the US government to find useful means of deterring cyberattacks. This latter NY Times article notes that Google may have found the best deterrence so far — the threat to withdraw its services from the Chinese market.Read more of this story at Slashdot.
-
Intego's "Year In Mac Security" Report
Posted: January 26th, 2010, 8:30am CET by kdawson
Tags: security
david.emery notes the release of Intego's "Year In Mac Security" report (PDF), adding: "Mac OS X and iPhones that haven't been jailbroken fare pretty well (although vulnerabilities exist, there's not been a lot of exploitation). Apple does come in for criticism for 'time to fix' known vulnerabilities. Jailbroken iPhones are a mess. The biggest risk to Macs are Trojan horses, often from pirated software."Read more of this story at Slashdot.
-
Insecure Plugins Ding IE, Safari, Chrome, Opera
Posted: January 26th, 2010, 12:46am CET by kdawson
Tags: security
krebsonsecurity writes "The Web browser wars often focus on which browser is more secure, but the dirty secret is that insecure plugins are a serious threat to all browsers, from the perspectives of both stability and security. Krebsonsecurity.com features an informative look at the administration page for a popular browser exploit kit called Eleonora, which suggests that plugins like Adobe Reader and Java are leading to successful compromises for users surfing not just with Internet Explorer, but also with Google Chrome, Firefox, Safari, and Opera."Read more of this story at Slashdot.
-
Researchers Claim "Effectively Perfect" Spam Blocking Discovery
Posted: January 25th, 2010, 9:43pm CET by ScuttleMonkey
Tags: spam
A team of computer scientists from the International Computer Science Institute in Berkeley, CA are claiming to have found an "effectively perfect" method for blocking spam. The new system deciphers the templates a botnet is using to create spam and then teaches filters what to look for. "The system ... works by exploiting a trick that spammers use to defeat email filters. As spam is churned out, subtle changes are typically incorporated into the messages to confound spam filters. Each message is generated from a template that specifies the message content and how it should be varied. The team reasoned that analyzing such messages could reveal the template that created them. And since the spam template describes the entire range of the emails a bot will send, possessing it might provide a watertight method of blocking spam from that bot."Read more of this story at Slashdot.
-
Data Breach Costs Top $200 Per Customer Record
Posted: January 25th, 2010, 7:30pm CET by CmdrTaco
Tags: security
alphadogg writes "The cost of a data breach increased last year to $204 per compromised customer record, according to the Ponemon Institute's annual study. The average total cost of a data breach rose from $6.65 million in 2008 to $6.75 million in 2009. The Ponemon Institute based its estimates on data from 45 companies that publicly acknowledged a breach of sensitive customer data last year and were willing to discuss it. In tallying the cost of a data breach, the Ponemon Institute looks at several factors, including: the cost of lost business because of an incident; legal fees; disclosure expenses related to customer contact and public response; consulting help; and remediation expenses such as technology and training."Read more of this story at Slashdot.
-
Chinese Human Rights Orgs Hit By DDoS
Posted: January 25th, 2010, 6:05pm CET by CmdrTaco
Tags: security
Oxford_Comma_Lover writes "IDG News Service is reporting that several human rights organizations focusing on China have been hit by DDoS attacks this weekend, including Chinese Human Rights Defenders and Civil Rights and Livelihood Watch. The latter works on issues of mental persecution (dissidents being thrown into mental hospitals where they were forced onto medication or beaten with electric batons) and eminent-domain type problems (seizure of farmland or urban land without compensation when the government is working on a project)."Read more of this story at Slashdot.
-
Australian ISPs To Disconnect Botnet "Zombies"
Posted: January 25th, 2010, 4:36pm CET by CmdrTaco
Tags: security
jibjibjib writes "Some of Australia's largest ISPs are preparing an industry code of conduct to identify and respond to users with botnet-infected computers. The Internet Industry Association, made up of over 200 ISPs and technology companies, is preparing the code in response to an ultimatum from the federal government. ISPs will try to contact the user, slow down their connection, and ultimately terminate the connection if the user refuses to fix the problem. It is hoped that this will reduce the growth of botnets in Australia, which had the world's third-highest rate of new 'zombies' (behind the US and China)."Read more of this story at Slashdot.
-
Radiation Therapy Mistakes Cost Lives
Posted: January 24th, 2010, 11:00pm CET by kdawson
Tags: medicine
jmtpi recommends a long NY Times investigative report about how powerful medical linear accelerators have contributed to at least two deaths in the New York area. Although the mistakes were largely due to human error, buggy software also played a role. "...the records described 621 mistakes from 2001 to 2008... most were minor... The Times found that on 133 occasions, devices used to shape or modulate radiation beams... were left out, wrongly positioned, or otherwise misused. On 284 occasions, radiation missed all or part of its intended target or treated the wrong body part entirely. ... Another patient with stomach cancer was treated for prostate cancer. Fifty patients received radiation intended for someone else, including one brain cancer patient who received radiation intended for breast cancer."Read more of this story at Slashdot.
-
Surveillance Backdoor Enabled Chinese Gmail Attack?
Posted: January 24th, 2010, 5:18pm CET by Soulskill
Tags: google
Major Blud writes "CNN is running an opinion piece on their front page from security technologist Bruce Schneier, in which he suggests that 'In order to comply with government search warrants on user data, Google created a backdoor access system into Gmail accounts. This feature is what the Chinese hackers exploited to gain access.' His article is short on sources, and the common belief is that a flaw in IE was the main attack method. Has this come up elsewhere? Schneier continues, 'Whether the eavesdroppers are the good guys or the bad guys, these systems put us all at greater risk. Communications systems that have no inherent eavesdropping capabilities are more secure than systems with those capabilities built in. And it's bad civic hygiene to build technologies that could someday be used to facilitate a police state.'"Read more of this story at Slashdot.
-
Crazy Firewall Log Activity — What Does It Mean?
Posted: January 24th, 2010, 3:24am CET by kdawson
Tags: internet
arkowitz writes "I happened to have access to five days worth of firewall logs from a US state government agency. I wrote a parser to grab unique IPs out, and sent several million of them to a company called Quova, who gave me back full location info on every 40th one. I then used Green Phosphor's Glasshouse visualization tool to have a look at the count of inbound packets, grouped by country of origin and hour. And it's freaking crazy looking. So I made the video of it and I'm asking the Slashdot community: What the heck is going on?"Read more of this story at Slashdot.
-
Widespread Attacks Exploit Newly-Patched IE Bug
Posted: January 23rd, 2010, 4:01pm CET by Soulskill
Tags: msie
itwbennett writes "The first widespread attack to leverage the Internet Explorer flaw that Microsoft patched in an emergency update Thursday morning has surfaced. By midday Thursday Symantec had spotted hundreds of Web sites that hosted the attack code. The attack installs a Trojan horse program that is able to bypass some security products and then give hackers access to the system, said Joshua Talbot, a security intelligence manager with Symantec. Once it has infected a PC, the Trojan sends a notification e-mail to the attackers, using a US-based, free e-mail service that Symantec declined to name." Relatedly, reader N!NJA was among several to point out that Microsoft has apparently been aware of this flaw since September.Read more of this story at Slashdot.
-
Who's Controlling Our Vital Information Systems?
Posted: January 23rd, 2010, 2:56pm CET by Soulskill
Tags: government
HangingChad writes "Gary Lyndaker talks about Janine Wedel's Shadow Elite; about how our information infrastructure is increasingly being sold off to the low bidder. Contracting in state and federal government is rampant, leaving more and more of our nation's vital information in the hands of contractors, many of whom have their own agenda and set of rules. From the article: 'Over 25 years, as an information systems developer, manager, and administrator in both state and private organizations, I have increasingly come to the conclusion that we are putting our state's operations at risk and compromising the trust of the people of our state by outsourcing core government functions.' I've seen the same thing in my years in government IT, ironically much of it as a contractor. My opinion is this is a dangerous trend that needs to be reversed. We're being fleeced while being put at risk."Read more of this story at Slashdot.
-
By Latest Count, 95% of Email Is Spam
Posted: January 23rd, 2010, 1:52pm CET by timothy
Tags: spam
An anonymous reader writes "The European Network and Information Security Agency released its new spam report, which looks at spam budgets, the impact of spam and spam management. Less than 5% of all email traffic is delivered to mailboxes. This means the main bulk of mails, 95%, is spam. This is a very minor change, from 6%, in earlier ENISA reports. Over 25% of respondents had spam accounting for more than 10% of help desk calls. The survey targeted email service providers of different types and sizes, and received replies from 100 respondents from 30 different countries."Read more of this story at Slashdot.
-
Court Rules WHOIS Privacy Illegal For Spammers
Posted: January 22nd, 2010, 6:39pm CET by kdawson
Tags: spam
Unequivocal writes "Spammers hiding behind a WHOIS privacy service have been found in violation of CAN-SPAM. It probably won't stop other spammers from hiding (what can?), but at least it adds another arrow in the legal quiver for skewering the bottom feeders. Quoting from the article: 'A recent decision by the Court of Appeals for the 9th Circuit has determined that using WHOIS privacy on domains may be considered "material falsification" under federal law... Although the ruling does not make use of WHOIS privacy illegal, it does serve as a clear message from the court that coupling the use of privacy services with intentional spamming will likely result in a violation of the CAN-SPAM act. This is an important decision that members of the domain community should refer to prior to utilizing a privacy shield.'"Read more of this story at Slashdot.
-
4 Out of 5 of .gov Web Sites Miss DNSSEC Deadline
Posted: January 22nd, 2010, 5:12pm CET by kdawson
Tags: government
netbuzz writes "Eighty percent US federal agencies — including the Department of Homeland Security — have missed a deadline to deploy DNS Security Extensions, a new authentication mechanism designed to prevent hackers from hijacking Web traffic. The deadline that whooshed by was Dec. 31, 2009. Experts disagree as to whether this level of deployment represents a failure or reasonable progress toward meeting a mandate set by the Office of Management and Budget in the summer of 2008. OMB officials declined to say why the agency hasn't enforced the DNSSEC deadline for executive branch departments."Read more of this story at Slashdot.
-
80% of .gov Web Sites Miss DNSSEC Deadline
Posted: January 22nd, 2010, 5:12pm CET by kdawson
Tags: government
netbuzz writes "Eighty percent of US federal agencies — including the Department of Homeland Security — have missed a deadline to deploy DNS Security Extensions, a new authentication mechanism designed to prevent hackers from hijacking Web traffic. The deadline that whooshed by was Dec. 31, 2009. Experts disagree as to whether this level of deployment represents a failure or reasonable progress toward meeting a mandate set by the Office of Management and Budget in the summer of 2008. OMB officials declined to say why the agency hasn't enforced the DNSSEC deadline for executive branch departments."Read more of this story at Slashdot.
-
Tor Users Urged To Update After Security Breach
Posted: January 22nd, 2010, 3:47am CET by timothy
Tags: privacy
An anonymous reader writes "If you use Tor, you're cautioned to update now due to a security breach. In a message on the Tor mailing list dated Jan 20, 2010, Tor developer Roger Dingledine outlines the issue and why you should upgrade to Tor 0.2.1.22 or 0.2.2.7-alpha now: 'In early January we discovered that two of the seven directory authorities were compromised (moria1 and gabelmoo), along with metrics.torproject.org, a new server we'd recently set up to serve metrics data and graphs. The three servers have since been reinstalled with service migrated to other servers.' Tor users should visit the download page and update ASAP."Read more of this story at Slashdot.
-
Microsoft Patches "Google Hack" Flaw In IE
Posted: January 21st, 2010, 10:40pm CET by timothy
Tags: msie
An anonymous reader writes "As expected, Microsoft has issued an out-of-band security patch to address a remote code execution hole in Internet Explorer that was used in the recent Chinese attacks disclosed by Google. Ars Technica has all the download links you need."Read more of this story at Slashdot.
-
Facebook Master Password Was "Chuck Norris"
Posted: January 21st, 2010, 8:56pm CET by samzenpus
Tags: privacy
I Don't Believe in Imaginary Property writes "A Facebook employee has given a tell-all interview with some very interesting things about Facebook's internals. Especially interesting are all the things relating to Facebook privacy. Basically, you don't have any. Nearly everything you've ever done on the site is recorded into a database. While they fire employees for snooping, more than a few have done it. There's an internal system to let them log into anyone's profile, though they have to be able to defend their reason for doing so. And they used to have a master password that could log into any Facebook profile: 'Chuck Norris.' Bruce Schneier might be jealous of that one."Read more of this story at Slashdot.
-
Mozilla Firefox 3.6 Released
Posted: January 21st, 2010, 8:52pm CET by timothy
Tags: mozilla
Shining Celebi writes "Mozilla has released Firefox 3.6 today, which adds support for Personas, lightweight themes that can be installed without restarting the browser, and adds further performance improvements to the new Tracemonkey Javascript engine. One of the major goals of the release was to improve startup time and general UI responsiveness, especially the Awesomebar. You can read the full set of release notes here."Read more of this story at Slashdot.
-
Analysis of 32 Million Breached Passwords
Posted: January 21st, 2010, 2:42pm CET by CmdrTaco
Tags: security
An anonymous reader writes "Imperva released a study analyzing 32 million passwords exposed in the Rockyou.com breach. The data provides a unique glimpse into the way that users select passwords and an opportunity to evaluate the true strength of these as a security mechanism. In the past, password studies have focused mostly on surveys. Never before has there been such a high volume of real-world passwords to examine." Most interesting to me was that in the sample, less than 4% used any non alpha-numerics in their #$#%'ing passwords.Read more of this story at Slashdot.
-
Microsoft To Issue Emergency IE Patch
Posted: January 21st, 2010, 1:57pm CET by samzenpus
Tags: microsoft
CWmike writes "Microsoft will release its emergency patch for Internet Explorer on Thursday, the company said, as it also admitted that attacks can be hidden inside rigged Office documents. 'We are planning to release the update as close to 10:00 a.m. PST as possible,' said Jerry Bryant, a program manager with the IE group. Microsoft has updated the security advisory it originally published last week when it acknowledged a zero-day IE vulnerability had been used by hackers to break into the corporate networks of Google and other major Western companies. Google has alleged that the attacks were launched by Chinese attackers. Subsequently, security experts have offered evidence that links the attacks to China."Read more of this story at Slashdot.
-
Apple Patches Massive Holes In OS X
Posted: January 20th, 2010, 10:23pm CET by timothy
Tags: macosx
Trailrunner7 writes with this snippet from ThreatPost: "Apple's first Mac OS X security update for 2010 is out, providing cover for at least 12 serious vulnerabilities. The update, rated critical, plugs security holes that could lead to code execution vulnerabilities if a Mac user is tricked into opening audio files or surfing to a rigged Web site." Hit the link for a list of the highlights among these fixes.Read more of this story at Slashdot.
-
Newly-Found Windows Bug Affects All Versions Since NT
Posted: January 20th, 2010, 4:17pm CET by Soulskill
Tags: windows
garg0yle writes "A researcher has found a security bug that could allow privilege escalation in Windows. Nothing new there, right? Well, this affects the Virtual DOS Machine, found in every 32-bit version of Windows all the way back to Windows NT. That's 17 years worth of Windows and counting. 'Using code written for the VDM, an unprivileged user can inject code of his choosing directly into the system's kernel, making it possible to make changes to highly sensitive parts of the operating system. ... The vulnerability exists in all 32-bit versions of Microsoft OSes released since 1993, and proof-of-concept code works on the XP, Server 2003, Vista, Server 2008, and 7 versions of Windows, Ormandy reported.'"Read more of this story at Slashdot.
-
Why "Running IT As a Business" Is a Bad Idea
Posted: January 19th, 2010, 10:12pm CET by kdawson
Tags: business
snydeq sends along a provocative piece from Infoworld, arguing that the conventional wisdom on how IT should be run is all wrong. "Bob Lewis dispels the familiar litany that 'IT should be run as a business,' instead offering insights into what he is calling a 'guerilla movement' to reject conventional 'IT wisdom' and industry punditry in favor of what experience tells you will work in real organizations. 'When IT is a business, selling to its "internal customers," its principal product is software that "meets requirements." This all but ensures a less-than-optimal solution, lack of business ownership, and poor acceptance of the results,' Lewis writes. 'The alternatives begin with a radically different model of the relationship between IT and the rest of the business — that IT must be integrated into the heart of the enterprise, and everyone in IT must collaborate as a peer with those in the business who need what they do.' To do otherwise is a sure sign of numbered days for IT, according to Lewis. After all, the standard 'run IT as a business' model had its origins in the IT outsourcing industry, 'which has a vested interest in encouraging internal IT to eliminate everything that makes it more attractive than outside service providers.'"Read more of this story at Slashdot.
-
Microsoft To Ship Emergency IE Patch
Posted: January 19th, 2010, 9:26pm CET by kdawson
Tags: msie
Grotendo writes "Microsoft plans to release an emergency patch for Internet Explorer very soon to counter targeted attacks and the publication of exploit code for a 'browse and you're owned' vulnerability in its flagship Web browser. The out-of-band update will be released once the company is satisfied that it has been properly tested against all affected versions of Windows. This could happen as early as this weekend." Microsoft has downplayed the seriousness of the IE zero-day, and insisted that it affects only IE6 even as security researchers close in on exploits for IE7 and IE8. Microsoft has had no comment about the firestorm that Google unleashed by directly accusing the Chinese of cyber espionage. ShadowServer has up a sobering post on the massive extent of the problem of "groups that can be referred to as the Advanced Persistent Threat."Read more of this story at Slashdot.
-
IBM Patenting Airport Profiling Technology
Posted: January 19th, 2010, 4:56pm CET by Soulskill
Tags: patents
An anonymous reader writes "InformationWeek's Wolfe's Den reports that IBM has filed a dozen applications to patent a sophisticated airport security system which supports passive software-based profiling of potentially dangerous passengers off of pre-programmed rules. The setup uses a collection of sensors — video, motion, biometric and even olfactory — in terminals and around the airport perimeter, to supply raw data. 'These patents are built on the inference engine, which [analyzes sensor data and] has the ability to calculate very large data sets in real time,' says co-inventor Roger Angell. A small grid of networked computers delivers the necessary processing power. Two applications go one better than Israeli-style security, analyzing furtive glances to detect, according to the title of the patent application, 'Behavioral Deviations by Measuring Eye Movements,' as well as measuring respiratory patterns."Read more of this story at Slashdot.
-
The Fourth Amendment and the Cloud
Posted: January 19th, 2010, 2:10pm CET by kdawson
Tags: court
CNET has up a blog post examining the question: does the Fourth Amendment apply to data stored in the Cloud? The US constitutional amendment forbidding unreasonable searches and seizures is well settled in regard to the physical world, but its application to electronic communications and computing lags behind. The post's argument outlines a law review article (PDF) from a University of Minnesota law student, David A. Couillard. "Hypothetically, if a briefcase is locked with a combination lock, the government could attempt to guess the combination until the briefcase unlocked; but because the briefcase is opaque, there is still a reasonable expectation of privacy in the unlocked container. In the context of virtual containers in the cloud...encryption is not simply a virtual lock and key; it is virtual opacity. ... [T]he service provider has a copy of the keys to a user's cloud 'storage unit,' much like a landlord or storage locker owner has keys to a tenant's space, a bank has the keys to a safe deposit box, and a postal carrier has the keys to a mailbox. Yet that does not give law enforcement the authority to use those third parties as a means to enter a private space. The same rationale should apply to the cloud." We might wish that the courts interpreted Fourth Amendment rights in this way, but so far they have not.Read more of this story at Slashdot.
-
D-Link Warns of Vulnerable Routers
Posted: January 19th, 2010, 3:53am CET by kdawson
Tags: bug
wiedzmin sends in news of a vulnerability in some D-Link home routers. The company has made new firmware available for download. "D-Link announced today that the problem, discovered by security researchers SourceSec, affects three of its wireless routers: DIR-855 (hardware version A2), DIR-655 (versions A1 to A4), and DIR-635 (version B). The problem lies in D-Link's implementation of Cisco's Home Network Administration Protocol, which allows remote router configuration. The scope of the vulnerability is greatly reduced by the fact that these router models were not shipped with the affected firmware by default, so only customers who updated their firmware are potentially affected. Or at least this was indicated in the company's response to the SourceSac claim that all D-Link routers sold since 2006 were affected." SourceSec apparently made their research available, including an exploitation tool, without ever contacting D-Link.Read more of this story at Slashdot.
-
France Tells Its Citizens To Abandon IE, Others Disagree
Posted: January 18th, 2010, 10:49pm CET by ScuttleMonkey
Tags: microsoft
Freistoss writes "Microsoft still has not released a patch for a major zero-day flaw in IE6 that was used by Chinese hackers to attack Google. After sample code was posted on a website, calls began for Microsoft to release an out-of-cycle patch. Now, France has joined Germany in recommending its citizens abandon IE altogether, rather than waiting for a patch. Microsoft still insists IE8 is the 'most secure browser on the market' and that they believe IE6 is the only browser susceptible to the flaw. However, security researchers warned that could soon change, and recommended considering alternative browsers as well." PCWorld seems to be taking the opposite stance arguing that blaming IE for attacks is a dangerous approach that could cause a false sense of security.Read more of this story at Slashdot.
-
Google Investigating Chinese Employees
Posted: January 18th, 2010, 6:02pm CET by CmdrTaco
Tags: google
BluePeppers writes "The Guardian is reporting that Google China is investigating its staff about The Incident. '"We're not commenting on rumor and speculation. This is an ongoing investigation and we simply cannot comment on the details," a Google spokeswoman said. Security analysts told Reuters the malicious software or malware used in the attack was a modification of a trojan called Hydraq. A trojan is a hidden program allowing unauthorized access to a computer. The analysts said the sophistication in the attack was in knowing whom to attack, not the malware itself.'"Read more of this story at Slashdot.
-
What's Holding Back Encryption?
Posted: January 18th, 2010, 5:14pm CET by CmdrTaco
Tags: encryption
nine-times writes "After many years in IT, I've been surprised to notice how much of my traffic is still unencrypted. A lot of businesses that I interact with (both business and personal) are still using unencrypted FTP, and very few people use any kind of encryption for email. Most websites are still using unencrypted HTTP. DNSSEC seems to be picking up some steam, but still doesn't seem to be widely used. I would have thought there would be a concerted effort to move toward encryption for the sake of security, but it doesn't seem to be happening. I wanted to ask the Slashdot community, what do you think the hold up is? Are the existing protocols somehow not good enough? Are the protocols fine, but not supported well enough in software? Is it too complicated to manage the various encryption protocols and keys? Is it ignorance or apathy on the part of the IT community, and that we've failed to demand it from our vendors?"Read more of this story at Slashdot.
-
Microsoft Says Upgrade To IE8, Even Though It's Vulnerable
Posted: January 18th, 2010, 3:33pm CET by CmdrTaco
Tags: msie
Barence writes "Microsoft has issued a statement urging people to upgrade their browser to IE8, after the zero-day exploit that was used to attack companies such as Google went public. According to Microsoft's security advisory: 'the vulnerability exists as an invalid pointer reference within Internet Explorer. It is possible under certain conditions for the invalid pointer to be accessed after an object is deleted. In a specially-crafted attack, in attempting to access a freed object, Internet Explorer can be caused to allow remote code execution.' But, although IE6 has been the source of the attacks until now, Microsoft's advisory admits that both IE7 and IE8 are vulnerable to the same flaw, even on Windows 7."Read more of this story at Slashdot.
-
Another Attack, On Law Firm Suing China
Posted: January 17th, 2010, 10:19am CET by timothy
Tags: government
An anonymous reader writes "In the wake of the attack on Google, another company claims to be the victim of a similar attack. Gipson Hoffman & Pancione is a Los Angeles law firm whose client, CYBERsitter, is suing the government of China and several Chinese companies for using their intellectual property in the infamous Green Dam censorship filter. According to the firm, they have been targeted by a spear phishing attack from China." Relatedly, smartaleckkill writes with news that the US state department is to formally protest to China over the alleged cyber-attacks on Google, "likely early next week."Read more of this story at Slashdot.
-
AMD Delivers DX11 Graphics Solution For Under $100
Posted: January 16th, 2010, 11:30pm CET by timothy
Tags: graphics
Vigile points out yesterday's launch of "the new AMD Radeon HD 5670, the first graphics card to bring DirectX 11 support to the sub-$100 market and offer next-generation features to almost any budget. The Redwood part (as it was codenamed) is nearly 3.5x smaller in die size than the first DX11 GPUs from AMD while still offering support for DirectCompute 5.0, Eyefinity multi-monitor gaming and of course DX11 features (like tessellation) in upcoming Windows gaming titles. Unfortunately, performance on the card is not revolutionary even for the $99 graphics market, though power consumption has been noticeably lowered while keeping the card well cooled in a single-slot design."Read more of this story at Slashdot.
-
MiFi Attack Exploits GPS To Reveal User's Location
Posted: January 16th, 2010, 9:20pm CET by timothy
Tags: privacy
An anonymous reader writes "Security researcher Adam Baldwin has identified that the Sprint and Verizon MiFi devices are vulnerable to a multitude of attacks. Combining these attacks together, an attacker can gain the GPS location of the MiFi device without the user becoming immediately aware. The attack can be successfully executed without authentication and even if the GPS has been disabled by the administrator." There's a video, but a handy text summary, too. Upshot: "Any MiFi user that visits a specially crafted page will give up their GPS location to the attacker."Read more of this story at Slashdot.
-
AT&T Glitch Connects Users To Wrong Accounts
Posted: January 16th, 2010, 4:01pm CET by Soulskill
Tags: security
CAE guy writes "The Boston Globe is carrying an AP report which begins: 'A Georgia mother and her two daughters logged onto Facebook from mobile phones last weekend and wound up in a startling place: strangers' accounts with full access to troves of private information. The glitch — the result of a routing problem at the family's wireless carrier, AT&T — revealed a little known security flaw with far reaching implications for everyone on the Internet, not just Facebook users.' Who needs to worry about man-in-the-middle attacks when your service provider will hijack your session for you?"Read more of this story at Slashdot.
-
Code Used To Attack Google Now Public
Posted: January 16th, 2010, 4:46am CET by timothy
Tags: security
itwbennett writes "The IE attack code used in last month's attack on Google and 33 other companies was submitted for analysis Thursday on the Wepawet malware analysis Web site. One day after being made publicly available, it had been included in at least one hacking tool and could be seen in online attacks, according to Dave Marcus, director of security research and communications at McAfee. Marcus noted that the attack is very reliable on IE 6 running on Windows XP, and could possibly be modified to work on newer versions of IE."Read more of this story at Slashdot.
-
Why Counter-Terrorism Is In Shambles
Posted: January 16th, 2010, 12:53am CET by ScuttleMonkey
Tags: government
Early last week several questions were submitted to former CIA analyst Ray McGovern about the sad state of counter-terrorism in the United States, and he has answered frankly and in-depth. In addition, McGovern solicited former FBI attorney/special agent Coleen Rowley to review his answers and provide her own comments. Ray's biggest tip to the intelligence community was to "HOLD ACCOUNTABLE THOSE RESPONSIBLE. More 'reform' is the last thing we need. Sorry, but we DO have to look back. The most effective step would be to release the CIA Inspector General report on intelligence community performance prior to 9/11. That investigation was run by, and its report was prepared by an honest man, it turns out. It was immediately suppressed by then-Acting DCI John McLaughlin — another Tenet clone — and McLaughin's successors as director, Porter Goss, Michael Hayden, and now Leon Panetta."Read more of this story at Slashdot.
-
US Preps Cyber Outfit To Protect Electric Grid
Posted: January 15th, 2010, 7:52pm CET by ScuttleMonkey
Tags: security
coondoggie writes to mention that the US Department of Energy is planning to set up a new "National Energy Sector Cyber Organization" in order to protect the national bulk power electric grid. For the low, low cost of $8.5 million they will help integrate smart grid technology with the electric grid, speed research, and establish new policy and protocols. "It is paramount that smart grid devices and interoperability standards include protections against cyber intrusions and have systems that are designed from the start (not patches added on) that prevent unauthorized persons from gaining entry through the millions of new access points created by the deployment of smart grid technologies, Hoffman stated."Read more of this story at Slashdot.
-
Airport Access IDs Hacked In Germany
Posted: January 15th, 2010, 10:50am CET by timothy
Tags: security
teqo writes "Hackers belonging to the Chaos Computer Club have allegedly cloned digital security ID cards for some German airports successfully which then allowed them access to all airport areas. According to the Spiegel Online article (transgoogleation here), they used a 200 Euro RFID reader to scan a valid security ID card, and since the scanner was able to pretend to be that card, used it to forge that valid ID. Even the airport authorities say that the involved system from 1992 might be outdated, but I guess it might be deployed elsewhere anyway."Read more of this story at Slashdot.
-
IE 0-Day Flaw Used In Chinese Attack
Posted: January 15th, 2010, 1:29am CET by timothy
Tags: msie
bheer writes "A zero-day attack on IE was used to carry out the cyber attack on Google and others that's been getting so much ink recently, reports The Register, quoting McAfee's CTO. While the web (and security) community has pointed out the problems with IE's many security flaws (and its sluggish update cycle) in the past, IE shows no sign of vanishing from the corporate landscape."Read more of this story at Slashdot.
-
Only 27% of Organizations Use Encryption
Posted: January 14th, 2010, 9:31am CET by samzenpus
Tags: encryption
An anonymous reader writes "According to a Check Point survey of 224 IT and security administrators, over 40% of businesses in the last year have more remote users connecting to the corporate network from home or when traveling, compared to 2008. The clear majority (77%) of businesses have up to a quarter of their total workforce consisting of regular remote users. Yet, regardless of the growth in remote users, just 27% of respondents say their companies currently use hard disk encryption to protect sensitive data on corporate endpoints. In addition, only 9% of businesses surveyed use encryption for removable storage devices, such as USB flash drives. A more mobile workforce carrying large amounts of data on portable devices leaves confidential corporate data vulnerable to loss, theft and interception."Read more of this story at Slashdot.
-
Gmail Moves To HTTPS By Default
Posted: January 13th, 2010, 11:34pm CET by timothy
Tags: security
clone53421 writes "Although Gmail has long supported HTTPS as an option, Gmail announced their decision yesterday to switch everyone to HTTPS by default: 'We initially left the choice of using it up to you because there's a downside: https can make your mail slower since encrypted data doesn't travel across the web as quickly as unencrypted data. Over the last few months, we've been researching the security/latency tradeoff and decided that turning https on for everyone was the right thing to do.' I wonder if this has anything to do with the reports of Chinese users having their accounts hacked? 'Only two Gmail accounts appear to have been accessed, and that activity was limited to account information (such as the date the account was created) and subject line, rather than the content of emails themselves,' said David Drummond in that blog update. That does sound like it perhaps could be a result of insecure HTTP traffic being intercepted in transit between the users and Gmail's servers."Read more of this story at Slashdot.
-
What To Expect From Windows 7 SP1
Posted: January 13th, 2010, 5:39pm CET by CmdrTaco
Tags: windows
snydeq writes "The first inklings of a public Windows 7 SP1 beta program are beginning to emerge, with hidden registry keys and a leaked list of post-RTM build numbers surfacing on the Web. 'Beyond the obvious bug fixes and security patches, we'll no doubt see support for the new USB 3.0 standard. Likewise, enhancements to the Bluetooth and Wi-Fi stacks will be slipstreamed in, allowing Windows 7 to retain its mantle as the most easily configured version ever,' writes InfoWorld's Randall Kennedy. 'But perhaps the most significant "update" to come out of Service Pack 1 will be the fact that it exists at all, and that by delivering it to market Microsoft will be signaling that it is now OK for IT shops to pull the trigger on their Windows 7 deployments.'"Read more of this story at Slashdot.
-
Forrester Says Tech Downturn Is "Unofficially Over"
Posted: January 13th, 2010, 4:51am CET by kdawson
Tags: money
alphadogg writes "The US IT market will grow by 6.6% as high-tech spending rebounds in 2010, according to Forrester Research's latest estimates. The research firm based its projections on data reported for 2009, though its fourth quarter numbers are incomplete. Forrester says hints of a recovery surfaced in the third quarter, and now the company expects the global IT market to grow by 8.1% in 2010. Forrester's US and Global IT Market Outlook: Q4 2009 reads: 'The tech downturn of 2008 and 2009 is unofficially over, while the Q3 2009 data for the US and the global market showed continued declines in tech purchases (as we expected). We predict that the Q4 2009 data will show a small increase in buying activity, or at worst, just a small decline.'"Read more of this story at Slashdot.
-
Google Hacked, May Pull Out of China
Posted: January 13th, 2010, 1:01am CET by kdawson
Tags: google
D H NG writes "Following a sophisticated attack on Google infrastructure originating from China late last year, Google has decided to take 'a new approach' to China. In their investigation, Google found that more than 20 large companies had been infiltrated and dozens of Chinese human rights activists' Gmail accounts had been compromised. Google has decided to 'review the feasibility of [its] business operations in China,' no longer censoring results in Google.cn, and if necessary, to 'shut down Google.cn, and potentially [Google's] offices in China.'"Read more of this story at Slashdot.
-
Twitter Hackers Take Down Baidu
Posted: January 12th, 2010, 10:51pm CET by kdawson
Tags: security
snydeq writes "The group that took down Twitter last month has apparently claimed another victim: China's largest search engine Baidu.com. Offline late Monday, Baidu.com at one point displayed an image saying 'This site has been hacked by Iranian Cyber Army,' according to a report in the official newspaper of the Chinese Communist Party and other Web sites. The Iranian Cyber Army first gained notoriety with its Dec. 18 Twitter attack. Baidu's domain name records were the focus of the hack. On Monday, the company was using domain name servers belonging to HostGator, a Florida ISP, instead of the Baidu.com nameservers the company normally uses."Read more of this story at Slashdot.
-
Second 3G GSM Cipher Cracked
Posted: January 12th, 2010, 2:48pm CET by Soulskill
Tags: encryption
Trailrunner7 writes "A group of cryptographers has developed a new attack that has broken Kasumi, the encryption algorithm used to secure traffic on 3G GSM wireless networks. The technique enables them to recover a full key by using a tactic known as a related-key attack, but experts say it is not the end of the world for Kasumi. Kasumi, also known as A5/3, is the standard cipher used to encrypt communications on 3G GSM networks, and it's a modified version of an older algorithm called Misty. In the abstract of their paper, the cryptographers say the attack can be implemented easily on one standard PC. 'In this paper we describe a new type of attack called a sandwich attack, and use it to construct a simple distinguisher for 7 of the 8 rounds of KASUMI with an amazingly high probability of 214. By using this distinguisher and analyzing the single remaining round, we can derive the complete 128 bit key of the full KASUMI by using only 4 related keys, 226 data, 230 bytes of memory, and 232 time. These complexities are so small that we have actually simulated the attack in less than two hours on a single PC, and experimentally verified its correctness and complexity.'"Read more of this story at Slashdot.
-
Firm To Drop Database, Web Server 0-Days
Posted: January 11th, 2010, 9:00pm CET by CmdrTaco
Tags: security
krebsonsecurity writes "January promises to be a busy month for Web server and database administrators alike: A security research firm in Russia says it plans to release information about a slew of previously undocumented vulnerabilities in several widely-used commercial software products, including Mysql, Tivoli, IBM DB2, Sun Directory, and a host of others, writes krebsonsecurity.com. From the blog: 'After working with the vendors long enough, we've come to conclusion that, to put it simply, it is a waste of time. Now, we do not contact with vendors and do not support so-called "responsible disclosure" policy,' Legerov said."Read more of this story at Slashdot.
-
Firm To Release Database, Web Server 0-Days
Posted: January 11th, 2010, 9:00pm CET by CmdrTaco
Tags: security
krebsonsecurity writes "January promises to be a busy month for Web server and database administrators alike: A security research firm in Russia says it plans to release information about a slew of previously undocumented vulnerabilities in several widely-used commercial software products, including MySQL, Tivoli, IBM DB2, Sun Directory, and a host of others, writes krebsonsecurity.com. From the blog: 'After working with the vendors long enough, we've come to conclusion that, to put it simply, it is a waste of time. Now, we do not contact with vendors and do not support so-called "responsible disclosure" policy,' Legerov said."Read more of this story at Slashdot.
-
Half of All Data Centers Understaffed
Posted: January 11th, 2010, 2:53pm CET by CmdrTaco
Tags: networking
alphadogg writes "Fifty percent of IT executives say their data centers are understaffed, and companies are still looking for more ways to cut costs, according to Symantec's latest 'State of the Data Center' report. Sixteen percent of survey respondents said their data centers are extremely understaffed, and another 34% called their data centers somewhat understaffed. At the same time, data centers are becoming more complex and harder to manage, with more applications, data and increasingly demanding service-level agreements. 'Data center complexity has led to a lot of staffing challenges,' says Sean Derrington, director of storage management and high availability at Symantec."Read more of this story at Slashdot.
-
Malware Threat Reports Are "Apples and Oranges"
Posted: January 11th, 2010, 7:31am CET by kdawson
Tags: security
Ant writes "The December malware threat reports are trickling in from vendors — and they all appear to be different. Fortinet, Sunbelt Software, and Kaspersky all published their lists of the most prevalent malware strains for the last month of 2009, but they didn't match up, leading to an admission that users will inevitably be confused by the results. Not only do the various security companies use different names for the threats they identify; they don't even identify the same threats."Read more of this story at Slashdot.
-
Malicious App In Android Market
Posted: January 10th, 2010, 11:39pm CET by kdawson
Tags: cellphones
dumbnose writes to let us know that a fraudulent app that attempts to steal bank information has made it to the Android app store. From the alert: "NOTICE: Users of mobile devices with Android software may have noticed several applications available for download in the Android Marketplace. If you see any applications provided by the user Droid09, please do not download these applications. Android applications provided by Droid09 are fraudulent. Please remove any applications by Droid09 from your mobile device and contact your mobile provider to evaluate whether any other applications or information stored on your mobile device have been compromised." Multiple marketplaces are possible in the open Android ecosystem. Might we see the emergence of a marketplace distinguished by an iPhone-like app vetting process?Read more of this story at Slashdot.
-
The FBI Wants To Know About Your IT Skills
Posted: January 10th, 2010, 3:09pm CET by Soulskill
Tags: database
AHuxley writes "The FBI, via the Office of Management and Budget, would like to find out more about your information technology expertise if you are part of InfraGard. Terms like 'practical utility' have been included in a 60-day emergency notice of information collection via the Paperwork Reduction Act of 1995. Is your boss or cubicle colleague part of InfraGard? It's a private, non-profit organization run as a public-private partnership with the Federal Bureau of Investigation. Are they passing info back about you or your company?"Read more of this story at Slashdot.
-
NIST Investigating Mass Flash Drive Vulnerability
Posted: January 9th, 2010, 11:05am CET by Soulskill
Tags: encryption
Lucas123 writes with a followup to news we discussed earlier this week that the encryption on NIST-certified flash drives was cracked. "A number of leading manufacturers of encrypted flash drives have warned their customers of a security flaw uncovered by a German company. The devices in question use the AES 256-bit encryption algorithm and have been certified using the FIPS 140-2, but the flaw appears to circumvent the certification process by uncovering the password authentication code on host systems. The National Institute of Standards and Technology said it's investigating whether it needs to modify its standards to include password authentication software on host systems. Security specialist Bruce Schneier was blunt in his characterization of the flaw: 'It's a stupid crypto mistake and they screwed up and they should be rightfully embarrassed for making it.'"Read more of this story at Slashdot.
-
Blizzard Authenticators May Become Mandatory
Posted: January 9th, 2010, 9:27am CET by Soulskill
Tags: security
An anonymous reader writes "WoW.com is reporting that a trusted source has informed them that Blizzard is giving serious consideration to making authenticators mandatory on all World of Warcraft accounts. The authenticators function the same as ones provided by most banks — in order to log in, you must generate a number on the external device. Blizzard already provides a free iPhone app that functions as an authenticator. The source stated, 'it is a virtually forgone conclusion that it will happen.' This comes after large spates of compromised accounts left Bizzard game masters severely backlogged by restoration requests."Read more of this story at Slashdot.
-
Recession Turning Software Auditors Into Greedy Traffic Cops
Posted: January 9th, 2010, 3:46am CET by Soulskill
Tags: Software
judgecorp writes "As the recession bites, software auditors are cracking down, and some are simply exploiting loopholes and technicalities to meet their targets, according to analyst Forrester. They may be within their rights, but they aren't endearing themselves to users; Steve Ballmer faced weary customers in London last year, and admitted Windows licenses have deliberate 'gotchas.'"Read more of this story at Slashdot.
-
Managing Young Sys Admins At Oregon State Open Source Lab
Posted: January 8th, 2010, 9:04pm CET by ScuttleMonkey
Tags: Education
mstansberry writes "Lance Albertson, architect and systems administrator at the Oregon State University Open Source Lab, uses a sys admin staff of 18-21-year-old undergrads to manage servers for some high-profile, open-source projects (Linux Master Kernel, Linux Foundation, Apache Software Foundation, and Drupal to name a few). In this Q&A, Albertson talks about the challenges of using young sys admins and the lab's plans to move from Cfengine to Puppet for systems management."Read more of this story at Slashdot.
-
France Considers 'Pirate Tax' For Online Ads
Posted: January 8th, 2010, 10:36am CET by samzenpus
Tags: internet
angry tapir writes "A report commissioned by the French Minister of Culture, Frédéric Mitterrand, urges the introduction of a tax on online advertising such as that carried by Google, which would be used to pay the creators of artistic and other works that lose out to online piracy."Read more of this story at Slashdot.
-
Hotmailers Hawking Hoax Hunan Half-Offs
Posted: January 7th, 2010, 10:05pm CET by kdawson
Tags: spam
Frequent Slashdot contributor Bennett Haselton writes "An estimated 200,000 Hotmail users currently have their auto-reply set to a message spamming an advertisement for Chinese scam websites, which sell "discounted" electronics. Presumably the spammers compromised a large number of Hotmail accounts to pull this off, but wouldn't it be pretty easy for Hotmail to query for which users have that set as their auto-reply, and turn the auto-reply off for them?" Read below for Bennett's thoughts.Read more of this story at Slashdot.
-
Factorization of a 768-Bit RSA Modulus
Posted: January 7th, 2010, 6:22pm CET by CmdrTaco
Tags: math
dtmos writes "The 768-bit, 232-digit number RSA-768 has been factored. 'The number RSA-768 was taken from the now obsolete RSA Challenge list as a representative 768-bit RSA modulus. This result is a record for factoring general integers. Factoring a 1024-bit RSA modulus would be about a thousand times harder, and a 768-bit RSA modulus is several thousands times harder to factor than a 512-bit one. Because the first factorization of a 512-bit RSA modulus was reported only a decade ago it is not unreasonable to expect that 1024-bit RSA moduli can be factored well within the next decade by an academic effort such as ours . . . . Thus, it would be prudent to phase out usage of 1024-bit RSA within the next three to four years.'"Read more of this story at Slashdot.
-
Windows 7 Has Lots of "God Modes"
Posted: January 7th, 2010, 5:00pm CET by CmdrTaco
Tags: windows
An anonymous reader writes "Those intrigued by the 'GodMode' in Windows 7 may be interested to know that there are many other similar shortcuts hidden within the operating system — some going back to Vista or before. Steven Sinofsky, Windows division president, said several similar undocumented features provide direct access to all kinds of settings, from choosing a location to managing power settings to identifying biometric sensors." Update: 01/07 23:46 GMT by CT : Link updated to source.Read more of this story at Slashdot.
-
2010 Bug Plagues Germany
Posted: January 7th, 2010, 2:47pm CET by CmdrTaco
Tags: bug
krou writes "According the Guardian, some 30 million chip and pin cards in Germany have been affected by a programming failure, which saw the microchips in cards unable to recognize the year change. The bug has left millions of credit and debit card users unable to withdraw money or make purchases, and has stranded many on holiday. French card manufacturer Gemalto accepted responsibility for the fault, 'which it is estimated will cost €300m (£270m) to rectify.' They claim cards in other countries made by Gemalto are unaffected."Read more of this story at Slashdot.
-
IT Job Satisfaction Plummets to All-time Low
Posted: January 7th, 2010, 7:14am CET by samzenpus
Tags: business
cweditor writes "IT job satisfaction has plummeted to a 10-year low, according to a recent survey. Another on general job satisfaction rated IT a paltry 45%. From the article: 'The CEB's latest survey found that the willingness of IT employees to "exert high levels of discretionary effort" -- put in extra hours to solve a problem, make suggestions for improving processes, and generally seek to play a key role in an organization -- has plummeted to its lowest levels since the survey was launched 10 years ago.'"Read more of this story at Slashdot.
-
IT Job Satisfaction Plummets To All-Time Low
Posted: January 7th, 2010, 7:14am CET by samzenpus
Tags: business
cweditor writes "IT job satisfaction has plummeted to a 10-year low, according to a recent survey. Another on general job satisfaction rated IT a paltry 45%. From the article: 'The CEB's latest survey found that the willingness of IT employees to "exert high levels of discretionary effort" — put in extra hours to solve a problem, make suggestions for improving processes, and generally seek to play a key role in an organization — has plummeted to its lowest levels since the survey was launched 10 years ago.'"Read more of this story at Slashdot.
-
FTC Worries About Consumers, Cloud Data, and Privacy
Posted: January 7th, 2010, 2:24am CET by samzenpus
Tags: security
pcause writes "Ars Techina has a nice article about the FTC's concern that consumers don't understand the implications of storing their data in the cloud. From the article: 'Data is now sitting on servers outside of your control, where it can be accessed far more easily by Google itself, hackers, and law enforcement than it ever could if kept within the device. Once data passes over the network, it gets much easier to access in realtime; once it is stored on a remote server, it gets much easier to access at any time. And those are just the phone settings. Google also has access to search history data, anything stored in Google Docs or Spreadsheets, complete schedules stored in Google Calendar, and recent Maps searches. Combine them all, and companies like Google become one-stop shops for authorities looking for personal information.' Do you think the average consumer even has a clue about this issue?"Read more of this story at Slashdot.
-
Fake "Bill Gates" Message Dupes Top Tools
Posted: January 6th, 2010, 11:00pm CET by timothy
Tags: security
yahoi writes with this excerpt from Dark Reading that might raise sysadmins' eyebrows about email security, in particular given the big names involved: "A researcher who conducted a successful spear-phishing experiment with a phony LinkedIn invitation from 'Bill Gates' is about to reveal the email products and services that failed to filter the spoofed message — and that list includes Microsoft Outlook 2007, Microsoft Exchange, Outlook Express, and Cisco IronPort. ... The experiment was aimed at measuring the effectiveness of email security controls in several major products and services. And the simplicity and success of the test demonstrated just how powerful social engineering can be and what little technology can actually do about it, security experts say."Read more of this story at Slashdot.
-
Blu-ray Capacity Increase Via Firmware
Posted: January 6th, 2010, 10:08pm CET by timothy
Tags: storage
LordofEntropy writes "Blu-ray.com reports that Sony and Panasonic have announced a new optical disc evaluation technology that increases capacity from 25GB to 33.4GB. The tech uses existing Blu-ray diodes and is accomplished via firmware upgrade. The article says it is not known if and when the upgrade will be adopted into the Blu-ray spec. However, given that Sony and Panasonic are behind it, 'it will likely happen later this year.'"Read more of this story at Slashdot.
-
2010 Will Be the Year of Sandboxing Apps
Posted: January 6th, 2010, 9:24pm CET by timothy
Tags: microsoft
Trailrunner7 writes "In a guest editorial on Threatpost, Mac hacker and security researcher Dino Dai Zovi writes that 2010 will be the year that software vendors get religion about sandboxing untrusted data in desktop apps. 'Instead of the usual top ten lists that are all-too-common with predictions for the new year, I have just one: 2010 will be the year of desktop applications handling untrusted data in sandboxed processes, and it will be about time. The largest Internet security threats now arrive through malicious web pages or e-mail attachments. This is because attackers are opportunistic and these are the weakest links especially because they easily pass through every firewall. Security is not and never was about SYN packets, it is about data: the software attack surface that attacker-controlled data interacts with and what sensitive data the attacker can get a hold of if they can exploit vulnerabilities in that software.'"Read more of this story at Slashdot.
-
Enterprise Security For the Executive
Posted: January 6th, 2010, 7:56pm CET by samzenpus
Tags: security
brothke writes "If Shakespeare were to write an information security tragedy, it would not be titled Hamlet, rather Bayuk. The story of Jennifer Bayuk is tragic in that she spent a decade as CISO at Bear, Stearns, building up its security group to be one of the best in the business; only to find it vaporized when the firm collapsed and was acquired by J.P. Morgan Clearing Corp. After all that toil and sweat, Bayuk was out of a job. (Full disclosure: Bayuk and I have given a presentation together in the past, and I did get a copy of this book for free.)" Read below for Ben's review.Read more of this story at Slashdot.
-
Nexus One vs. Top 10 Phone Security Requirements
Posted: January 6th, 2010, 5:43pm CET by CmdrTaco
Tags: cellphones
hiouridah writes "Consumer Grade or Enterprise Ready? The Nexus One is entering a smart phone market that is taking increasing heat from enterprises for their lack of robust security features. So how does the Nexus One stack up?"Read more of this story at Slashdot.
-
Alleged Ponzi Mastermind Hacked In Antigua
Posted: January 6th, 2010, 2:11pm CET by kdawson
Tags: security
krebsonsecurity writes "Criminal hackers apparently involved in break-ins at several US financial institutions also appear to have dug up dirt on Robert Allen Stanford, a man slated to go on trial this month for his alleged part in an $8 billion Ponzi scheme. Quoting: 'In early 2008, while federal investigators were busy investigating disgraced financier Robert Allen Stanford for his part in an alleged $8 billion fraudulent investment scheme, Eastern European hackers were quietly hoovering up tens of thousands customer financial records from the Bank of Antigua, an institution formerly owned by the Stanford Group.'"Read more of this story at Slashdot.
-
Office Work Ethic In the IT Industry?
Posted: January 6th, 2010, 11:04am CET by kdawson
Tags: business
An anonymous reader writes "As a recent graduate entering industry for the first time at a large software and hardware company, I have been shocked at what seems to be a low standard of work ethic and professionalism at my place of employment, especially in this poor economy. For example, at my company, the large majority of developers seem to each individually waste — no exaggeration — hours of time on the clock every day talking about football, making personal phone calls, gossiping, taking long lunches, or browsing the Internet (including, yes, Slashdot!). Even some of our subcontractors waste time in this manner. Being the 'new guy,' I get stuck with much of the weekend and after-hours grunt work when we inevitably miss deadlines or produce poor code. I'm not in any position to go around telling others to use their time more efficiently. Management seems to tolerate it. I would like to ask Slashdot what methods others have used to deal with office environments such as this. Is my situation unique or is it common across the industry?"Read more of this story at Slashdot.
-
Y2.01K
Posted: January 6th, 2010, 7:54am CET by kdawson
Tags: security
After our recent discussion of decimal/hexadecimal confusion at the turn of 2010, alphadogg writes in with a Network World survey of wider problems caused by the date change. "A decade after the Y2K crisis, date changes still pose technology problems, making some security software upgrades difficult and locking millions of bank ATM users out of their accounts. Chips used in bank cards to identify account numbers could not read the year 2010 properly, making it impossible for ATMs and point of sale machines in Germany to read debit cards of 30 million people since New Year's Day, according to published reports. The workaround is to reprogram the machines so the chips don't have to deal with the number. In Australia, point-of-sales machines skipped ahead to 2016 rather than 2010 at midnight Dec. 31, rendering them unusable by retailers, some of whom reported thousands of dollars in lost sales. Meanwhile Symantec's network-access control software that is supposed to check whether spam and virus definitions have been updated recently enough fails because of this 2010 problem."Read more of this story at Slashdot.
-
Slovak Police Planted Explosives On Air Travelers
Posted: January 6th, 2010, 12:40am CET by kdawson
Tags: security
Entropy98 writes "Slovakian Police have planted explosives on 8 unsuspecting air travelers. Seven were stopped by airport security, including one man arrested and held upon arriving at a Dublin airport. Unbelievably, one innocent traveler made it home with 90 grams of explosives, and had his flat surrounded by the police and bomb squad."Read more of this story at Slashdot.
-
Fixing Security Issue Isn't Always the Right Answer
Posted: January 5th, 2010, 8:30pm CET by kdawson
Tags: security
Trailrunner7 writes "In a column on Threatpost, Bruce Schneier writes that the recent security breach at Newark Airport shows that fixing a given security problem isn't always the right move. 'An unidentified man breached airport security at Newark Airport on Sunday, walking into the secured area through the exit, prompting an evacuation of a terminal and flight delays that continued into the next day. This problem isn't common, but it happens regularly. The result is always the same, and it's not obvious that fixing the problem is the right solution. American airports can do more to secure against this risk, but I'm reasonably sure it's not worth it. We could double the guards to reduce the risk of inattentiveness, and redesign the airports to make this kind of thing less likely, but that's an expensive solution to an already rare problem. As much as I don't like saying it, the smartest thing is probably to live with this occasional but major inconvenience.'"Read more of this story at Slashdot.
-
Encryption Cracked On NIST-Certified Flash Drives
Posted: January 5th, 2010, 7:37pm CET by timothy
Tags: security
An anonymous reader writes "USB Flash drives with hardware based AES 256-bit encryption manufactured by Kingston, SanDisk and Verbatim have reportedly been cracked by security firm SySS. These drives are advertised to meet security standards suitable for use with sensitive US Government data (unclassified, of course) as emphasized by the FIPS 140-2 Level 2 certificate issued by the US National Institute of Standards and Technology (NIST). It looks likes the Windows-based password entry program always sends the same character string to the drive after performing various crypto operations."Read more of this story at Slashdot.
-
Adobe Security Chief Defends JavaScript Support
Posted: January 5th, 2010, 6:00pm CET by timothy
Tags: security
Trailrunner7 writes "Despite the fact that the majority of [PDF-related] malware exploits use JavaScript to trigger an attack in Adobe's PDF Reader product, the company says it's impossible to completely remove JavaScript support without causing major compatibility problems. In a Q&A on Threatpost, Adobe security chief Brad Arkin says the removal of JavaScript support is a non-starter because it's an integral part of how users do form submissions. '"Anytime you're working with a PDF where you're entering information, JavaScript is used to do things like verify that the date you entered is the right format. If you're entering a phone number for a certain country it'll verify that you've got the right number of digits. When you click 'submit' on the form it'll go to the right place. All of this stuff has JavaScript behind the scenes making it work and it's difficult to remove without causing problems," Arkin explained.'"Read more of this story at Slashdot.
-
Can Imaging Technologies Save Us From Terrorists?
Posted: January 5th, 2010, 5:08pm CET by timothy
Tags: privacy
itwbennett writes "In the aftermath of the failed Christmas Day terrorist attack, full body scanning technologies such as millimeter wave and backscatter are regaining popularity, writes blogger Steven J. Vaughan-Nichols in a recent post. But, he asks, do they really work? The TSA seems to think so. It has just issued a contract to purchase more millimeter wave scanners from L3 Communications. Michael Chertoff, the former homeland security secretary, told the New York Times that if these scanners had been in place, they would have caught the would-be bomber. Ben Wallace, the Conservative Member of Parliament in the United Kingdom, disagrees, saying that the technologies can't detect the kind of low-density explosive that the would-be terrorist tried to use on December 25th."Read more of this story at Slashdot.
-
IT Workers To Get Fewer Perks, No Free Coffee
Posted: January 5th, 2010, 3:35pm CET by timothy
Tags: business
dasButcher writes "While the economy is showing signs of recovery and tech stocks posted double- and triple-digit gains in 2009, IT workers are facing a less hospitable workplace in the coming year. Many employers say they're going to continue trimming budgets, particularly in human resources. Rather than giving up head count, they're planning to trim 401k contributions, eliminate bonuses, curtail travel and, dare we say, shut off the free coffee (it wasn't that good anyway)."Read more of this story at Slashdot.
-
DVD-CSS's Encryption Not Enough? Here Comes DECE
Posted: January 5th, 2010, 2:49pm CET by timothy
Tags: encryption
An anonymous reader writes "Studios digitally restricting (drm) or locking down content with DVD-CSS not enough for you? Well, get ready, here comes the entertainment cartel's Holy Grail, all-hardware encryption, via 'DECE.' And let's not forget this little issue."Read more of this story at Slashdot.
-
Kodak Wireless Picture Frames Open To Public
Posted: January 5th, 2010, 2:07pm CET by kdawson
Tags: privacy
Jaxoreth writes "The Kodak Easyshare Wireless Digital Picture Frame displays images via a per-frame RSS feed hosted by FrameChannel. Each frame's URL is identical except for a parameter matching its particular MAC address, enabling public browsing of users' feeds. And worse, if you reach the feed of a not-yet-activated frame, it gives you the code to activate it, allowing you to preload it with whatever content you choose."Read more of this story at Slashdot.
-
Core i5 and i3 CPUs With On-Chip GPUs Launched
Posted: January 4th, 2010, 10:36am CET by timothy
Tags: intel
MojoKid writes "Intel has officially launched their new Core i5 and Core i3 lineup of Arrandale and Clarkdale processors today, for mobile and desktop platforms respectively. Like Intel's recent release of the Pinetrail platform for netbooks, new Arrandale and Clarkdale processors combine both an integrated memory controller (DDR3) and GPU (graphics processor) on the same package as the main processor. Though it's not a monolithic device, but is built upon multi-chip module packaging, it does allow these primary functional blocks to coexist in a single chip footprint or socket. In addition, Intel beefed up their graphics core and it appears that the new Intel GMA HD integrated graphics engine offers solid HD video performance and even a bit of light gaming capability."Read more of this story at Slashdot.
-
Do IT Pros Abuse Their Power?
Posted: January 3rd, 2010, 6:15pm CET by Soulskill
Tags: IT
An anonymous reader writes "I have noticed that many airports and hospitals I've visited have some kind of internet usage policy in place. Some use software similar to Websense, which effectively blocks sites based on blacklisting them by category. A commonly used blacklist prevents users from accessing 'forums or discussion boards,' yet I find that often these networks allow users to access sites like Fark, Slashdot, Digg and other message boards that appeal to the technical culture one might find in the IT world. In your experience, do IT administrators abuse their supervisory powers? Has there ever been a backlash from users or management for doing so?"Read more of this story at Slashdot.
-
2016 Bug Hits Text Messages, Payment Processing
Posted: January 3rd, 2010, 3:01pm CET by Soulskill
Tags: bug
An anonymous reader writes "It seems some systems are suffering from a Y2K16 bug. When 2009 ticked over to 2010, some Australian EFTPOS machines skipped to the year 2016. Coincidentally, some Windows Mobile users are also having issues with their new year SMSes coming from 2016. What function could cause this kind of error?"Read more of this story at Slashdot.
-
Scambaiting Gets Comical; Internet Scammers All Dressed Up
Posted: January 3rd, 2010, 10:40am CET by timothy
Tags: humor
Nurse Nasty writes "Scambaiting is a fun and relaxing full-contact email sport. It's all about baiting Internet and email scammers into exposing themselves and sharing that humiliation with the entire world. Recently I baited four different groups of Internet scammers into being comic book action super-heroes, and then giving them their own 10-page graphic novel. It's a bit of fun and eduction through entertainment." (Warning: The comic contains a bit of naughty language.)Read more of this story at Slashdot.
-
SpamAssassin 2010 Bug
Posted: January 2nd, 2010, 2:10am CET by Soulskill
Tags: bug
SEWilco writes "You might want to check your spam folder, as SpamAssassin has a rule which is tending to mark email sent in 2010 as spam. There is some discussion in a bug report. The SpamAssassin Wiki FH_DATE_PAST_20XX page doesn't have discussion, but it was updated today with a different date rule."Read more of this story at Slashdot.
-
Online Services Let Virus Writers Check Their Work
Posted: January 1st, 2010, 7:00pm CET by ScuttleMonkey
Tags: security
An anonymous reader writes "Former Washington Post Security Fix blogger Brian Krebs has launched a new blog at krebsonsecurity.com, and his first story highlights a pair of underground antivirus scanning services that cater to virus writers. Scanning services like virustotal.com scan submitted files against dozens of antivirus products, and share the results with each of the vendors so that all benefit from learning about threats they don't yet detect. But there are number of budding online services that allow customers to pay per scan, and promise that the results will never get reported back to the antivirus companies. One service even tests how well web site 'exploit packs' are detected, while others promise additional layers of protection. 'The service claims that it will soon be rolling out advanced features, such as testing malware against anti-spyware and firewall programs, as well as a test to see whether the malware functions in a virtual machine.'"Read more of this story at Slashdot.
-
The Long Shadow of Y2K
Posted: January 1st, 2010, 1:52pm CET by timothy
Tags: IT
Hugh Pickens writes "It seems like it was only yesterday when the entire world was abuzz about the looming catastrophe of Y2K that had us both panicked and prepared. Ten Years ago there were doomsday predictions that planes would fall from the sky and electric grids would go black, forced into obsolescence by the inability of computers to recognize the precise moment that 1999 rolled over to 2000 and for many it was a time to feel anxious about getting money out of bank accounts and fuel out of gas pumps. "Nobody really understood what impact it was going to have, when that clock rolled over and those digits went to zero. There was a lot of speculation they would reset back to 1900," says IT professional. Jake DeWoskin. The Y2K bug may have been IT's moment in the sun, but it also cast a long shadow in its wake as the years and months leading up to it were a hard slog for virtually everyone in IT, from project managers to programmers."Read more of this story at Slashdot.