Read more of this story at Slashdot.
Feeds
34723 items (30210 unread) in 5 feeds
OpenSource
(5765 unread)
-
SourceForge.net: Front page news
(802 unread)
-
Slashdot: IT (4963 unread)
Security
(11364 unread)
-
Digg / Security (11364 unread)
Linux
(13081 unread)
-
-
Slashdot: Linux (1660 unread)
Slashdot: IT (91 unread)
-
Palin Email Snoop Found Guilty On 2 Charges
Posted: April 30th, 2010, 10:49pm CEST by Soulskill
Tags: communications
netbuzz writes "A federal jury in Knoxville today has convicted David Kernell, 22, of two charges — misdemeanor computer fraud and felony obstruction of justice — in connection with the 2008 episode where he accessed the personal Yahoo email account of Republican vice presidential candidate Sarah Palin and then initiated a worldwide rummaging of its contents. The obstruction charge carries a maximum prison term of 20 years." -
Recourse For Draconian Encryption Requirements?
Posted: April 30th, 2010, 5:03pm CEST by kdawson
Tags: encryption
CryoStasis writes in with this question, which likely resulted from the new Massachusetts data security law. "I work for a major hospital in the Northeast. Recently the hospital has taken it upon itself to increase its general level of computer security. As a result they now require full-disk encryption on any computer connected to their network on site. Although I think this stance is perhaps a little over-exuberant, most of these computers are machines that have been purchased with hospital funding. In the department that I work in, however, many of the employees (myself included) bring their own personal machines to work every day. For obvious reasons we're rather reluctant to allow the hospital's IT staff to attempt installation of the encryption software. Those who have allowed the installation have had major problems afterwards, on both Macs and Windows machines — ranging from severe/total data loss to frequent crashes to general slowness — which the hospital does very little to remedy. To make matters worse, the hospital is now demanding that any machine that is used to check email (via email clients or webmail directly) be encrypted, including desktop-style machines at home, which must be brought in to the IT department, as they refuse to distribute the encryption software to the employees for install. By monitoring email access they have begun harassing employees who check email from off campus, stating that their email/login access will be disabled unless they bring in their computers. I have no intention of letting these people install anything on my machine, particularly software of which their IT staff clearly doesn't have a solid grasp. Have other Slashdot readers come across this kind of a problem? Do I have any recourse, legal or otherwise, to stop them from requiring me to install software on my personal machines?"Read more of this story at Slashdot.
-
DNSSEC May Cause Problems On May 5
Posted: April 30th, 2010, 3:37pm CEST by kdawson
Tags: security
An anonymous reader notes the coming milestone of May 5, at 17:00 UTC — at this time DNSSEC will be rolled out across all 13 root servers. Some Internet users, especially those inside corporations and behind smaller ISPs, may experience intermittent problems. The reason is that some older networking equipment is preconfigured to block any reply to a DNS request that exceeds 512 bytes in size. DNSSEC replies are typically four times as large. "DNSSEC is in fact already rolled out across most of the world's 13 root servers. ... But to date ... it would only have resulted in a slight lag in the loading of a web page for those with outdated network equipment. The beauty of DNS is that should a request made to one root server not receive a response, the DNS resolver on a user's machine simply makes the same request along the line of the 13 root servers until it gets a satisfactory response. But on May 5, once all 13 root servers are live with the DNSSEC signatures, responses from all 13 root servers won't make it back inside the corporate LAN on some older systems. ... The problem may take several days to surface and be inconsistent from one user's PC to the next. A user at one machine who hasn't switched on his PC for two or three days will have no access to the Internet. A user who left his machine on the night before will have some pages — and responses from DNS servers — cached on his machine, and will still have connectivity." The article links a test site you can use ahead of time to check for any problems.Read more of this story at Slashdot.
-
India, China Try Import Regulations As Security Tools
Posted: April 29th, 2010, 9:22pm CEST by timothy
Tags: security
An anonymous reader writes "The Register reports that the Chinese government is forcing vendors to cough up the source code to their encryption alogrithms before they can sell their equipment to the Chinese government. The EU doesn't seem to like it, but if I were in their position I'd want the same thing." China's biggest neighbor goes further; another anonymous reader writes "Telco equipment from China could have spyware that gives access to telcom networks in India. The Indian government has officially told mobile operators not to import any equipment manufactured by Chinese vendors, including Huawei and ZTE. The ban order follows concerns raised by the Home Ministry that telecom equipment from some countries could have spyware or malware that gives intelligence agencies across the border access to telecom networks in India. The biggest gainers from the move could be Ericsson, Nokia, and Siemens, which have been losing market share to aggressive Chinese equipment-makers in India."Read more of this story at Slashdot.
-
Juror Explains Guilty Vote In Terry Childs Case
Posted: April 29th, 2010, 7:53pm CEST by timothy
Tags: court
alphadogg writes "Terry Childs, the San Francisco network administrator who refused to hand over passwords to his boss, was found guilty of one felony count of denying computer services, a jury found Tuesday. Now, one of those jurors (Jason Chilton, juror #4) is speaking out in an interview with IDG News Service's Bob McMillan: 'The questions were, first, did the defendant know he caused a disruption or a denial of computer service. It was rather easy for us to answer, "Yes there was a denial of service." And that service was the ability to administer the routers and switches of the FiberWAN. That was the first aspect of it. The second aspect was the denial to an authorized user. And for us that's what we really had to spend the most time on, defining who an authorized user was. Because that wasn't one of the definitions given to us.'"Read more of this story at Slashdot.
-
Symantec To Acquire PGP and GuardianEdge
Posted: April 29th, 2010, 6:29pm CEST by CmdrTaco
Tags: business
An anonymous reader noticed the news that Symantec has bought PGP and Guardian Edge for $370 million. They plan to standardize their encryption stuff on PGP keys.Read more of this story at Slashdot.
-
Texas Man Pleads Guilty To Building Botnet-For-Hire
Posted: April 29th, 2010, 6:49am CEST by samzenpus
Tags: botnet
Julie188 writes "A Mesquite, Texas, man is set to plead guilty to training his 22,000-PC botnet on a local ISP — just to show off its firepower to a potential customer. David Anthony Edwards will plead guilty to charges that he and another man, Thomas James Frederick Smith, built a custom botnet, called Nettick, which they then tried to sell to cybercriminals at the rate of US$0.15 per infected computer, according to court documents."Read more of this story at Slashdot.
-
The US Continues Its Reign As King of Spam
Posted: April 29th, 2010, 4:33am CEST by samzenpus
Tags: security
An anonymous reader writes "The United States continues its reign as the king of spam, relaying more than 13% of global spam, accounting for hundreds of millions of junk messages every day, according to a report by Sophos. However, most dramatically, China – often blamed for cybercrime by other countries – has disappeared from the 'dirty dozen,' coming in at 15th place with responsibility for relaying just 1.9% of the world's spam."Read more of this story at Slashdot.
-
Rough Justice For Terry Childs
Posted: April 29th, 2010, 12:08am CEST by timothy
Tags: court
snydeq writes "Deep End's Paul Venezia sees significant negative ramifications for IT admins in the wake of yesterday's guilty verdict for Terry Childs on a count of 'denial of service.' Assuming the verdict is correct, Venezia writes, 'shouldn't the letter of the law be applied to other "denial of service" problems caused by the city while they pursued this case? In particular, to the person or persons who released hundreds of passwords in public court filings in 2008 for causing a denial of service for the city's widespread VPN services? After all, once the story broke that a large list of usernames and passwords had been released to the public, the city had to take down its VPN services for days while they reset every password and communicated those changes to the users.' Worse, if upheld on appeal, the verdict puts a vast number of IT admins at risk. 'There are suddenly thousands of IT workers all over the country that are now guilty of this crime in a vast number of ways. If the letter of the law is what convicted Terry Childs, then the law is simply wrong.'"Read more of this story at Slashdot.
-
Anyone Can Play Big Brother With BitTorrent
Posted: April 28th, 2010, 10:43pm CEST by timothy
Tags: internet
An anonymous reader writes "I was at the 3rd USENIX Workshop on Large-Scale Exploits and Emergent Threats yesterday, and there were people from the French Institute for Computer Science who have continuously spied on most BitTorrent users on the Internet for 100 days, from a single machine. They've also identified 70% of all content providers; yes, those guys that insert the new contents into BitTorrent. As a BitTorrent user, I was shocked that anyone with a box connected to the Internet can spy on what everyone is downloading on BitTorrent."Read more of this story at Slashdot.
-
Free Remote Access Tools For Windows and Mac Compared
Posted: April 28th, 2010, 9:40pm CEST by timothy
Tags: microsoft
snydeq writes "InfoWorld's Keith Schultz provides an in-depth comparison of seven free remote access tools for Windows, four of which offer compatibility with the Mac. 'As you read about each tool, you'll notice that I put a lot of emphasis on remote printing. I rely on remote access tools on a daily basis, and in most cases I need to be able to print to my remote PC. For someone that just wants to check their home/office email account or view documents from outside the office, all of the utilities here will work fine. But for those trying to get some serious work done, remote printing may be the deal breaker.' Many of the free tools under review offer paid or licensed versions for access to additional features."Read more of this story at Slashdot.
-
Computer Competency Test For Non-IT Hires?
Posted: April 28th, 2010, 3:52am CEST by kdawson
Tags: business
wto605 writes "As computers are used for more and more vital business functions, small businesses must have office employees who understand the dangers of, and how to recognize and avoid, malware, spam, and phishing. After having been stung by monthly virus cleanups (at $75 an hour) due to an otherwise competent office manager, my parents have realized they need to be aware of their employees' computer skills beyond the ability to type a letter in Microsoft Word (currently the closest thing they have to a test of computer competence). The problem is, as a small business, they have no IT expert who would be able to judge a potential employee's competency. I'm wondering if anyone knows of a good way to test these security/safety awareness skills, such as an online test, a set of questions, etc. I have already pointed them to Sonicwall's Spam and Phishing test, but it definitely does not cover all of the issues facing computer users."Read more of this story at Slashdot.
-
Terry Childs Found Guilty
Posted: April 28th, 2010, 12:56am CEST by kdawson
Tags: court
A jury in San Francisco found Terry Childs guilty of one felony count of computer tampering. The trial lasted four months. Childs now faces a maximum sentence of five years in prison.Read more of this story at Slashdot.
-
Fake Antivirus Peddlers Outpacing Real AV Firms
Posted: April 27th, 2010, 8:56pm CEST by kdawson
Tags: security
An anonymous reader tips a writeup at KrebsOnSecurity.com detailing how purveyors of fake antivirus or 'scareware' programs have aggressively stepped up their game to evade detection. The posting is based on a report from Google's malware detection team (PDF). "Beginning in June 2009, Google charted a massive increase in the number of unique fake antivirus installer programs, a spike that Google security experts posit was a bid to overwhelm the ability of legitimate antivirus programs to detect the programs. Indeed, the company discovered that during that time frame, the number of unique installer programs increased from an average of 300 to 1,462 per day, causing the detection rate to plummet to below 20 percent. ... In addition, Google determined that the average lifetime of sites that redirect users to Web pages that try to install scareware decreased over time, with the median lifetime dropping below 100 hours around April 2009, below 10 hours around September 2009, and below one hour since January 2010."Read more of this story at Slashdot.
-
Backdoor Malware Targets Apple iPad
Posted: April 27th, 2010, 3:04pm CEST by CmdrTaco
Tags: security
An anonymous reader writes "Apple iPad users are being warned of an email-borne threat which could give hackers unauthorised access to the device. The threat arrives via an unsolicited email urging the recipient to download the latest version of iTunes as a prelude to updating their iPad software. Apart from opening up a backdoor, it also tries to read the keys and serial numbers of the software installed on the device, and logs the passwords to any webmail, IM or protected storage accounts."Read more of this story at Slashdot.
-
New Russian Weapon Hides In Shipping Container
Posted: April 27th, 2010, 11:20am CEST by kdawson
Tags: security
shmG writes "A Russian company is marketing a devastating new cruise missile system that can be hidden inside a shipping container, giving any merchant vessel the capability to wipe out an aircraft carrier. Potential customers for the formidable 'Club-K' system include Kremlin allies Iran and Venezuela, say defense experts. They worry that countries could pass on the satellite-guided missiles, which are very hard to detect, to terrorist groups. This is a scary new development in the global arms race that allows for the proliferation of cruise missiles to anyone who will pay for them — even terrorists. This could be the next big thing in strategic weapons, as they can appear anywhere there is a container ship. The company even made a commercial and posted it onto the Internet." The article notes that a Russian defense expert said that "as far as he understood, the Club-K was still at the concept stage."Read more of this story at Slashdot.
-
All GSM Phones Open To Attack, Tracking
Posted: April 26th, 2010, 8:49pm CEST by Soulskill
Tags: cellphones
Trailrunner7 writes "A pair of security researchers has discovered a number of new attack vectors that give them the ability not only to locate any GSM mobile handset anywhere in the world, but also to find the name of the subscriber associated with virtually any cellular phone number, raising serious privacy and security concerns for customers of all of the major mobile providers. The research builds upon earlier work on geolocation of GSM handsets and exposes a number of fundamental weaknesses in the architecture of mobile providers' networks. However, these are not software or hardware vulnerabilities that can be patched or mitigated with workarounds. Rather, they are features and functionality built into the networks and back-end systems that Bailey and DePetrillo have found ways to abuse in order to discover information that most cell users assume is private and known only to the cell provider."Read more of this story at Slashdot.
-
Massive Number of GoDaddy WordPress Blogs Hacked
Posted: April 26th, 2010, 5:54pm CEST by CmdrTaco
Tags: security
A nasty little exploit has hit a large number of GoDaddy-hosted WordPress blogs this weekend. The best part is that the exploit only executes when the traffic is referred by Google, making it the sort of thing that site maintainers won't easily notice. Clever and devious.Read more of this story at Slashdot.
-
Massive Number of GoDaddy WordPress Blogs Hacked
Posted: April 26th, 2010, 5:54pm CEST by CmdrTaco
Tags: google
A nasty little exploit has hit a large number of GoDaddy-hosted WordPress blogs this weekend. The best part is that the exploit only executes when the traffic is referred by Google, making it the sort of thing that site maintainers won't easily notice. Clever and devious.Read more of this story at Slashdot.
-
Punishing Security Breaches
Posted: April 26th, 2010, 5:10pm CEST by CmdrTaco
Tags: security
Schneier has a story on his blog this morning about punishing security breaches. This one is in response to the tale of Gray Powell, the Apple engineer who left an important bit of technology in a bar recently. You might have heard of it. You also might have been on either the breacher or the corporate side. I'd hate to be in either position myself.Read more of this story at Slashdot.
-
McAfee To Pay For PC Repairs After Patch Fiasco
Posted: April 26th, 2010, 4:27pm CEST by CmdrTaco
Tags: security
Barence writes "McAfee has offered to pay for the PC repairs of consumers affected by last week's faulty antivirus update. The problematic patch falsely identified the SVCHOST.EXE Windows file as a virus, causing PCs running Windows XP SP3 to crash or enter endless reboot cycles. In a blog post addressed to 'Home or Home Office Consumers,' the company offered to reimburse PC repair expenses, though there was a notable caveat. 'If you have already incurred costs to repair your PC as a result of this issue, we're committed to reimbursing reasonable expenses,' the company said. 'Reasonable expenses' has yet to be formally defined."Read more of this story at Slashdot.
-
How To Get 39 Megapixels From a 53-Year-Old Camera
Posted: April 25th, 2010, 10:37pm CEST by timothy
Tags: inputdev
G3ckoG33k writes "An article at The Register Hardware describes how Hasselblad film cameras dating back to 1957 can be given a new life using a digital back to get images at a super resolution of 39 megapixels. From the article: 'The CFV-39 digital back allows you to get those cameras out from the last century and use the V-System cameras with their beautiful glass once again, it simply fits in place of where the roll film used to be. Hasselblads have never been inexpensive, but talk about a return on investment. Here is a manufacturer looking after a fiercely loyal user-base and along with it offering what could be seen as the ultimate green camera system.' Oh, by the way most pictures taken during the Apollo space program in the 1960s were taken with Hasselblad." Hasselblad's been making digital backs for quite a while now, but this one's very impressive in speed (and cost — "only" about $14,000) compared to earlier models.Read more of this story at Slashdot.
-
Mass. Data Security Law Says "Thou Shalt Encrypt"
Posted: April 25th, 2010, 8:28pm CEST by timothy
Tags: privacy
emeraldd writes with this snippet from SQL Magazine summarizing what he calls a "rather scary" new data protection law from Massachusetts: "Here are the basics of the new law. If you have personally identifiable information (PII) about a Massachusetts resident, such as a first and last name, then you have to encrypt that data on the wire and as it's persisted. Sending PII over HTTP instead of HTTPS? That's a big no-no. Storing the name of a customer in SQL Server without the data being encrypted? No way, Jose. You'll get a fine of $5,000 per breach or lost record. If you have a database that contains 1,000 names of Massachusetts residents and lose it without the data being encrypted, that's $5,000,000. Yikes.'"Read more of this story at Slashdot.
-
Russian Hacker Selling 1.5M Facebook Accounts
Posted: April 25th, 2010, 6:22pm CEST by Soulskill
Tags: crime
Sir Codelot writes "A hacker who calls himself Kirllos has obtained and is now offering to sell 1.5 million Facebook IDs at astonishingly low prices — $25 per 1,000 IDs for users with fewer than 10 friends and $45 per 1,000 IDs for users with more than 10 friends. Looking at the numbers, Kirllos has stolen the IDs of one out of every 300 Facebook users. Quoting: 'VeriSign director of cyber intelligence Rick Howard told the New York Times that it appeared close to 700,000 had already been sold. Kirllos would have earned at least $25,000 from the scam. Howard told the newspaper that it was not apparent whether the accounts and passwords were legitimate, but a Russian underground hacking magazine reported it had tested some of Kirllos' previous samples and managed to get into people's accounts.'"Read more of this story at Slashdot.
-
Reconstructing Users' Web Histories From Personalized Search Results
Posted: April 25th, 2010, 4:16pm CEST by Soulskill
Tags: google
An anonymous reader sends along this excerpt from MIT's Technology Review: "Personalization is a key part of Internet search, providing more relevant results and gaining loyal customers in the process. But new research highlights the privacy risks that this kind of personalization can bring. A team of European researchers, working with a researcher from the University of California, Irvine, found that they were able to hijack Google's personalized search suggestions to reconstruct users' Web search histories (PDF). Google has plugged most of the holes identified in the research, but the researchers say that other personalized services are likely to have similar vulnerabilities."Read more of this story at Slashdot.
-
Several Link-Spam Architectures Revealed
Posted: April 25th, 2010, 11:23am CEST by timothy
Tags: internet
workie writes "Using data derived from website infections, RescueTheWeb.org has found several interesting link-spam architectures. One architecture is where concentric layers of hijacked websites are used to increase the page rank and breadth of reach (within search engine search results) of scam sites. The outer layers link to the inner layers, eventually linking to a site that redirects the user to the scam site. Another architecture involves hijacked sites that redirect the user to fake copies of Google, having the appearance that the visitor is still within Google, but in reality they are on a Google lookalike that contains only nefarious links."Read more of this story at Slashdot.
-
Twitter and the Rise of Data Platforms
Posted: April 24th, 2010, 7:37pm CEST by Soulskill
Tags: social
snydeq writes "Fatal Exception's Neil McAllister sees Twitter's latest move — to develop 'analytical products' based on Twitter data and to encourage third-party developers to do the same — as part of a growing trend toward a new kind of software platform. 'In the past, tool vendors have offered developers languages and code libraries that gave them access to computing functions in simple, standardized ways. In this new paradigm, however, a platform consists of more than just frameworks and APIs. It also comes prepackaged with a complete, rich data set, and often that data is the platform's most valuable aspect. These new "data platforms" are creating exciting new opportunities for developers, though they are not without their challenges.' Chief among these issues are privacy and security, as evidenced by a recent letter to Google from government regulators and activist tools such as PleaseRobMe. But for developers, the challenges also include livelihood. 'Even more than mobile platforms such as Apple's iPhone, a data platform like Twitter's is a walled garden. If Twitter cuts off a developer's access to its data sources for any reason, that developer's business is sunk.' Even those who develop 'cloud middleware' around such data platforms stand to gain little from their efforts, as doing so pits them in competition with their data platform vendors, which are in a far better position to reach potential customers."Read more of this story at Slashdot.
-
Phishing Education Test Blocked For Phishing
Posted: April 24th, 2010, 5:33pm CEST by Soulskill
Tags: security
An anonymous reader writes "It appears a website called ismycreditcardstolen.com, designed to 'educate users about the dangers of phishing,' has itself been flagged by Firefox as a reported web forgery. The site, which asks visitors to enter their credit card details to 'see if they've been stolen,' takes the hapless visitor to a page warning them about the perils of phishing, giving them advice on how to avoid similar scams and also provides a link to the Anti-Phishing Working Group's website. Or at least it did, until various browsers started blocking it. As the Sunbelt blog post notes, the project was likely doomed to failure, both because of the domain name itself and also because it uses anonymous Whois data, which isn't exactly going to make security people look at it in a positive light. Does anyone out there think this was a good idea? Or will malicious individuals start playing copycat on a public now trained to think sites like this are just 'harmless education?'"Read more of this story at Slashdot.
-
Confessions of a SysAdmin
Posted: April 23rd, 2010, 11:30pm CEST by Soulskill
Tags: IT
Mr.Fork writes "Scott Merrill from CrunchGear has a confession. He really, really hates computers. He writes: 'No, really, I hate them. I love the communications they facilitate, I love the conveniences they provide to my life, and I love the escapism they sometimes afford; but I actually hate the computers themselves. Computers are fragile, unintuitive things — a hodge-podge of brittle hardware and opaque, restrictive software.' Does his editorial speak to all of us in similar IT-related fields? Do we all silently hate the complexities and idiosyncrasies computers have, like error messages and UI designs that make no sense to the common user, which make our tech professions miserable?"Read more of this story at Slashdot.
-
Blippy Exposes Credit Card Numbers Through Simple Google Search
Posted: April 23rd, 2010, 9:25pm CEST by Soulskill
Tags: business
An anonymous reader writes "In an unfortunate data breach, social media site Blippy has left credit card numbers in clear text, searchable via a simple Google query. The results show the amount spent on a transaction, the location, and the full card number. As of this submission, the issue still hasn't been resolved." The company's co-founder, Philip Kaplan, told the NY Times, "... when people link their credit cards to Blippy, merchants pass along their raw transaction data – including some credit card numbers – and the site scrubs that information to present just the merchant and the dollar amount spent. But several months ago, when Blippy was being publicly tested, that raw transaction data was present in the site's HTML code, where it was retrieved by Google. Mr. Kaplan said that early on, Blippy started disguising the raw transaction data behind the scenes, but it did not know about the breach until today."Read more of this story at Slashdot.
-
Fatal System Error
Posted: April 23rd, 2010, 5:09pm CEST by samzenpus
Tags: security
brothke writes "As computing and technology has evolved, so too have the security threats correspondingly evolved. The classic Yankee Doodle virus of 1989 did minimal damage, all while playing a patriotic, albeit monotone song. In 2010, aggressive malware now executes in stealth mode, running in the background with an oblivious end-user, and antivirus software that can’t detect it." Read on for the rest of Ben's review.Read more of this story at Slashdot.
-
Ubuntu LTS Experiences X.org Memory Leak
Posted: April 21st, 2010, 10:25pm CEST by timothy
Tags: bug
MonsterTrimble writes "Ubuntu 10.04 LTS Beta 2 is experiencing a major memory leak due to patches for X.org. 'An X.Org Server update that was pushed into the Lucid repository last week has resulted in the system being slower and slower as it is left on, until it reaches a point where the system is no longer usable. ... In order to make the Ubuntu 10.04 LTS deadline, the developers are looking at just reverting three of the patches, which brings the GLX version back to 1.2. Ubuntu developers are now desperate for people willing to test out this updated X.Org Server package so they can determine by this Friday whether to ship it with Ubuntu 10.04 LTS or doing an early SRU (Stable Release Update). Right now this X.Org Server that's being tested is living in the ubuntu-x-swat PPA.'"Read more of this story at Slashdot.
-
McAfee Kills SVCHost.exe, Sets Off Reboot Loops For Win XP, Win 2000
Posted: April 21st, 2010, 8:00pm CEST by timothy
Tags: bug
Kohenkatz writes "A McAfee Update today (DAT 5958) incorrectly identifies svchost.exe, a critical Windows executable, as a virus and tries to remove it, causing endless reboot loops." Reader jswackh adds this terse description: "So far the fixes are sneakernet only. An IT person will have to touch all affected PCs. Reports say that it quarantines SVCHOST. [Affected computers] have no network access, and missing are taskbar/icons/etc. Basically non-functioning. Windows 7 seems to be unaffected." Updated 20100421 20:08 GMT by timothy: An anonymous reader points out this easy-to-follow fix for the McAfee flub.Read more of this story at Slashdot.
-
Next Gen Intel CPUs Move To Yet Another Socket
Posted: April 21st, 2010, 4:18pm CEST by CmdrTaco
Tags: intel
mr_sifter writes "According to a leaked roadmap, next year we'll be saying hello to LGA1155. The socket is 1-pin different from the current LGA1156 socket Core i3, i5, and some i7s use. Sandy Bridge CPUs will be based on the current 32nm, second-generation High-k metal gate manufacturing process. All LGA1155 CPUs will have integrated graphics built into the core instead of a separate chip. This is an upgrade from the current IGP, PCI Express controller and memory controller in Clarkdale CPUs. which is manufactured on the older 45nm process in a separate die (but still slapped together the same package). This should improve performance, as all the controllers will be in one die, like existing LGA1366 CPUs."Read more of this story at Slashdot.
-
Escalating Gmail/Spamming Attacks
Posted: April 21st, 2010, 12:44am CEST by kdawson
Tags: spam
We've been getting submissions about an uptick in compromised Gmail accounts in the last few days, but nothing that could be substantiated. Robert McMillan did a bit of digging and now reports in PC World that "Google is investigating a growing number of reports that hackers are breaking into legitimate Gmail accounts and then using them to send spam messages. The problem started about a week ago but seems to have escalated over the past few days. ... [I]n forum posts, Gmail users note that the hackers appear to be sending spam via Gmail's mobile interface — which gives mobile-phone users a way to check their Gmail accounts — and wonder if there may be a bug in the mobile interface that is allowing criminals to send the spam. ... Google says there's no Gmail bug. ... 'Spammers may sometimes use a mobile interface to access accounts they have already compromised because it's simpler for bots to use this method at large scale.'" Here's how to tell if your Gmail account has been accessed by bad guys, and what to do about it.Read more of this story at Slashdot.
-
Fate of Terry Childs Now In Jury's Hands
Posted: April 20th, 2010, 9:35pm CEST by kdawson
Tags: court
snydeq writes "Closing arguments concluded Monday in the city of San Francisco's case against Terry Childs, the network administrator charged with violating California hacking laws by refusing to hand over network passwords for the city's FiberWAN during a 12-day period in 2008. Childs was charged in July 2008 and has been held on $5 million bail ever since. The highly technical trial, which featured testimony from San Francisco Mayor Gavin Newsom and Cisco Chief Security Officer John Stewart, has dragged on for nearly six months. By Monday, five of the 18 jurors and alternates selected for the trial had dropped out, and the remaining jurors seemed relieved to see the arguments wrap up as they left the courtroom Monday afternoon. They will return Tuesday to start their deliberations. Childs faces five years in prison if he is convicted for disrupting service to the city's computer system by withholding administrative passwords — a verdict that, if rendered, puts all IT admins in danger."Read more of this story at Slashdot.
-
Digital Photocopiers Loaded With Secrets
Posted: April 20th, 2010, 7:15pm CEST by CmdrTaco
Tags: security
skids writes 'File this under "no, really?" CBS news catches up with the fact that photocopiers, whether networked or not, tend to have a much longer memory these days. When they eventually get tossed, few companies bother to scrub them. Couple this with the tendency of older employees to consider hard-copy to be "secure," and your most protected secrets may be shipped directly to information resellers — no hacking required. "The day we visited the New Jersey warehouse, two shipping containers packed with used copiers were headed overseas — loaded with secrets on their way to unknown buyers in Argentina and Singapore."'Read more of this story at Slashdot.
-
Hidden Cores On Phenom CPUs Can Be Unlocked
Posted: April 20th, 2010, 5:51pm CEST by CmdrTaco
Tags: amd
An anonymous reader writes "One of the major ways a semiconductor manufacturer manages to make the most of its chips is through binning. Chips able to cope with high clock speeds with all cores running end up as premium product lines, while others end up as models rated at lower speed grades, or with fewer cores. In the case of AMD's Phenom CPUs, dual and triple core models are quad cores with some disabled, while some newer quad core CPUs are actually six core models with two disabled. To this end both ASUS and MSI have announced that they have modified versions of AMD 890FX- and 890GX-based motherboards to unlock these hidden cores. Much like overclocking, there is no guarantee that you will gain anything by unlocking the hidden cores — everything depends on just why your CPU ended up in a certain product line."Read more of this story at Slashdot.
-
Quantum Cryptography Now Fast Enough For Video
Posted: April 20th, 2010, 10:42am CEST by kdawson
Tags: encryption
cremeglace sends in news of a major advance in the speed of quantum key distribution. "Researchers at the Cambridge Lab of Toshiba Research Europe have solved the problem of transferring highly sensitive data at high speed across a long distance network. The team were able to demonstrate the continuous operation of quantum key distribution (QKD) — a system that allows the communicating users to detect if a third party is trying to eavesdrop on the data communication — at a speed greater than one megabit/sec over a 50 km fibre optic network, thanks to the use of a light detector for high bit rates and a feedback system which maintains the high bit rates during data transfer. ... The faster one megabit/sec data handling will allow the one-time pad to be used for the encryption of video — a vast step forward over the current ability to only encrypt voice data."Read more of this story at Slashdot.
-
IE8's XSS Filter Exposes Sites To XSS Attacks
Posted: April 20th, 2010, 7:22am CEST by kdawson
Tags: msie
Blue Taxes writes "The cross-site scripting filter that ships with Microsoft's Internet Explorer 8 browser can be abused by attackers to launch cross-site scripting attacks on websites and web pages that would otherwise be immune to this threat. The IE8 filter works by scanning outbound requests for strings that may be malicious. When such a string is detected, IE8 will dynamically generate a regular expression matching the outbound string. The browser then looks for the same pattern in responses from the server. If a match is made anywhere in the server's response, the browser assumes that a reflected XSS attack is being conducted and the browser will automatically alter the response so that the XSS attack cannot succeed. The researchers figured out a way to use IE8's altered response to conduct simple abuses and universal cross-site scripting attacks, which worked against sites that would not otherwise have been vulnerable to XSS." Here is the researchers' backgrounder (PDF) on the attack. Microsoft says that they have issued two patches that address the issue, but the researchers insist that holes remain. Update: 04/20 14:06 GMT by KD : Microsoft's Security Response Center has issued a statement on the vulnerability.Read more of this story at Slashdot.
-
Source Code To Google Authentication System Stolen
Posted: April 20th, 2010, 4:04am CEST by kdawson
Tags: google
Aardvark writes "More details are coming out about the extent of the break-in at Google a few months ago. The NY Times is reporting that one of the things stolen was the source code to Google's single sign-on authentication system, called Gaia. Though Google is making changes to the system, the theft raises the possibility that attackers could analyze the code to find new exploits to take advantage of in the future. No wonder that Eric Schmidt recently said they've become paranoid about security."Read more of this story at Slashdot.
-
Network Solutions Sites Hacked Again
Posted: April 19th, 2010, 10:17pm CEST by Soulskill
Tags: security
CWmike writes "A week after Web hosting company Network Solutions dealt with a large-scale infection of WordPress-driven blogs, the company acknowledged that other sites it hosts have been compromised. 'We have received reports that Network Solutions customers are seeing malicious code added to their websites and we are really sorry for this experience,' said spokesman Shashi Bellamkonda in a blog post. 'At this time, since anything we say in public may help the perpetrators, we are unable to provide details.' Securi Security Labs said on Sunday that at least 50 sites hosted by Networks Solutions had been hacked, and that malicious JavaScript injected into those sites was redirecting unsuspecting users to a Ukrainian attack server. The same server was involved in the earlier attacks against Network Solutions-hosted blogs. According to the StopMalvertising blog, the attacks planted a rogue IFRAME on the hacked sites to shunt users to the attack server. That server then launches multiple exploits, including an attack kit of ActiveX exploits and three more leveraging Adobe Reader vulnerabilities, against visiting PCs. Several browsers, including IE8, Chrome and Firefox, display warnings when users are redirected to the attack site."Read more of this story at Slashdot.
-
Palm WebOS Hacked Via SMS Messages
Posted: April 19th, 2010, 7:26pm CEST by Soulskill
Tags: cellphones
gondaba writes "Security researchers at the Intrepidus Group have hacked into Palm's new WebOS platform, using nothing more than text messages to exploit a slew of dangerous web app vulnerabilities. The white hat hackers found that the WebOS SMS client did not properly perform input/output validation on any SMS messages sent to the handset, leading to a rudimentary HTML injection bug. Coupled with the fact that HTML injection leads directly to injecting code into a WebOS application, the attacks made possible were quite dangerous (especially considering they could all be delivered over an SMS message)."Read more of this story at Slashdot.
-
Life Recorder
Posted: April 19th, 2010, 3:53pm CEST by CmdrTaco
Tags: security
Bruce Schneier writes "In 2006, writing about future threats on privacy, I described a life recorder: A 'life recorder' you can wear on your lapel that constantly records is still a few generations off: 200 gigabytes/year for audio and 700 gigabytes/year for video. It'll be sold as a security device, so that no one can attack you without being recorded."Read more of this story at Slashdot.
-
Life Recorder
Posted: April 19th, 2010, 3:53pm CEST by CmdrTaco
Tags: inputdev
Bruce Schneier writes "In 2006, writing about future threats on privacy, I described a life recorder: A 'life recorder' you can wear on your lapel that constantly records is still a few generations off: 200 gigabytes/year for audio and 700 gigabytes/year for video. It'll be sold as a security device, so that no one can attack you without being recorded."Read more of this story at Slashdot.
-
Virtualizing Workstations For Common Hardware?
Posted: April 19th, 2010, 4:29am CEST by kdawson
Tags: ubuntu
An anonymous reader writes "We have approximately 20 workstations which all have different hardware specs. Every workstation has two monitors and generally runs either Ubuntu or Windows. I had started using Clonezilla to copy the installs so we could deploy new workstations quickly and easily, when we have hardware failures or the like, but am struggling with Windows requiring new drivers to be installed for all new hardware. Obviously we could be booting into Ubuntu and then load a Windows virtual machine after that, but I'd prefer not to have the added load of a full GUI underneath Windows — we want maximum performance possible. And I don't think the multi-monitor support would work. Is it possible to have a very basic virtual machine beneath to provide hardware consistency whilst still allowing multi-monitor support? Does anyone have any experience with a technique like this?"Read more of this story at Slashdot.
-
Become an SSLAdmin In a Few Easy Steps
Posted: April 18th, 2010, 3:15pm CEST by Soulskill
Tags: security
Renderer of Evil writes "With news that it is rather simple to mimic authority with many webmail providers in order to coax an SSL certificate authority into creating one for the domain, a Canadian security expert has decided to take it upon himself to see who out there is actually vulnerable and provide information to the public on how prevalent this issue is as we speak. Out of eleven webmail services chosen at random and without prejudice, just under half of them permitted him to register with credentials (ssladmin) that allowed him to create an SSL certificate in their name. In most of these cases, there was a pre-existing, legitimately-acquired certificate." Update: 04/19 01:30 GMT by S : Kurt Seifried's original paper, on which the BetaNews article is based, provides more detailed information on the subject (PDF).Read more of this story at Slashdot.
-
SIP Attacks From Amazon EC2 Going Unaddressed
Posted: April 18th, 2010, 3:39am CEST by kdawson
Tags: security
mjgraves writes "Over the past week a number of IP-PBX systems have been suffering SIP attacks from hosts in the Amazon EC2 cloud. At least a dozen known attacks have been reported to Amazon, which has been surprisingly quiet about the matter. The issue has been well documented by one of the attack victims on his blog. The matter was also discussed on the April 16th issue of the VoIP Users Conference (podcast available at the link; EC2 segment begins around 3:30). Amazon appears to have gone silent on the matter even as the attacks are ongoing. This is completely irresponsible behavior from a such a hosting company, which should be acting to take down the attacker in their midst."Read more of this story at Slashdot.
-
Fraud Fighter "Bobbear" To Close Up Shop
Posted: April 18th, 2010, 12:01am CEST by kdawson
Tags: crime
Krebsonsecurity.com has a writeup on the decision of UK anti-fraud activist site bobbear.co.uk to retire from the fray. The 66-year-old fraud fighter said he was getting too old for the work, which takes him about 15 hours a day. "We had so many messages of thanks, and congratulations on the site, but it is so stressful and takes so much out of you, and there is always the worry of litigation hanging over your head." "The owner and curator of bobbear.co.uk, a site that specializes in exposing Internet fraud scams and phantom online companies, announced Saturday that he will be shuttering the site at the end of April. Bobbear and its companion site bobbear.com are creations of [the pseudonomous] Bob Harrison, a 66-year-old UK resident who for the last four years has tirelessly chronicled and exposed a myriad of fraud and scam Web sites. The sites, which are well-indexed by Google and other search engines and receive about 2,000 hits per day, often are among the first results returned in a search for the names of fly-by-night corporations advertised in spam and aimed at swindling the unsuspecting or duping the unwitting." Any ideas on who might want to take over the domains and carry on the work would be appreciated by the Internet community at large.Read more of this story at Slashdot.
-
Google Drafts Cloud Printing Plan For Chrome OS
Posted: April 16th, 2010, 10:24pm CEST by Soulskill
Tags: google
snydeq writes "Google is unveiling early-stage designs, software code, and documentation for a project whose goal is to let users of the company's Chrome OS print documents to any printer from any application. Called Google Cloud Print, the technology would dispense with the need to install printer drivers by routing print jobs from Web, desktop, and mobile applications via a Chrome OS Web-hosted broker. 'Rather than rely on the local operating system — or drivers — to print, apps can use Google Cloud Print to submit and manage print jobs. Google Cloud Print will then be responsible for sending the print job to the appropriate printer with the particular options the user selected, and returning the job status to the app.'"Read more of this story at Slashdot.
-
ClamAV Forced Upgrade Breaks Email Servers
Posted: April 16th, 2010, 7:35pm CEST by kdawson
Tags: security
An anonymous reader writes "A couple of weeks ago Sourcefire announced end-of-life for version 0.94 of its free ClamAV antivirus package (and in fact has been talking about it for six months). The method that Sourcefire chose to retire 0.94 was to shut down the server that provided its service. Those who had failed to upgrade are scrambling now. Many systems have no choice but to disable virus checking in order to continue to process email. I am very glad I saw the announcement last week!"Read more of this story at Slashdot.
-
How Do I Fight Russian Site Cloners?
Posted: April 16th, 2010, 4:41pm CEST by kdawson
Tags: crime
An anonymous reader writes "I used to run a small web design service, the domain for which I allowed to expire after years of non-use. A few weeks ago, I noticed that my old site was back online at the old domain. The site-cloners are now using my old email addresses to gain access to old third-party web services accounts (invoicing tools, etc.) and are fraudulently billing my clients for years of services. I've contacted the Russian site host, PayPal, and the invoicing service. What more can I do? Can I fight back?"Read more of this story at Slashdot.
-
Porn Virus Blackmails Victims Over "Copyright Violation"
Posted: April 16th, 2010, 11:29am CEST by timothy
Tags: security
FishRep writes with this excerpt from the BBC: "A new type of malware infects PCs using file-share sites and publishes the user's net history on a public website before demanding a fee for its removal. The Japanese trojan virus installs itself on computers using a popular file-share service called Winni, used by up to 200m people. It targets those downloading illegal copies of games in the Hentai genre, an explicit form of anime. Website Yomiuri claims that 5,500 people have so far admitted to being infected. The virus, known as Kenzero, is being monitored by web security firm Trend Micro in Japan. Masquerading as a game installation screen, it requests the PC owner's personal details. It then takes screengrabs of the user's web history and publishes it online in their name, before sending an e-mail or pop-up screen demanding a credit card payment of 1,500 yen (£10) to 'settle your violation of copyright law' and remove the webpage."Read more of this story at Slashdot.
-
What Can Be Done About Security of Debit Cards?
Posted: April 16th, 2010, 2:31am CEST by timothy
Tags: security
JumpDrive writes "I have been the victim of (Visa) debit card theft. I do not know where they stole or got the number, but it was used one day on the other side of the country and the next day it was used in Europe until they cleaned out my account. I had been monitoring my account online and immediately went to the bank and filed a claim. I was told at that time it would be 3 to 5 weeks for them to investigate the claim before they could return my money. Recently I tried to make a purchase with a debit card and was told that they couldn't use the card since it wasn't a Visa or MasterCard check card; this led to a discussion of why I no longer have a Visa or MasterCard check card. Which then led to the question of 'What can be done about it?' Currently I have a separate account for debit usage for my personal safety. But I also think that those producing these check cards should be required to advertise the hazards of having one of these cards (not in small print and maybe required in advertisement of these cards, similar to what is required with pharmaceutical drugs on television) and/or that if a debit or check card is issued a separate account should be required for its use, and users informed of the issues of placing all of their money in the same account that their debit card has access to. What other precautionary measures should be required or taken?"Read more of this story at Slashdot.
-
Sun Pushes Emergency Java Patch
Posted: April 15th, 2010, 9:53pm CEST by timothy
Tags: security
Trailrunner7 writes "In a sudden about-face, Sun has rushed out a Java update to fix a drive-by download vulnerability that exposed Windows users to in-the-wild malware attacks. The patch comes less than a week after Sun told a Google researcher it did not consider the issue serious enough to warrant an out-of-cycle patch and less than a day after researchers spotted live exploits on a booby-trapped Web site. The flaw, which was also discovered independently by Ruben Santamarta, occurs because the Java-Plugin Browser is running 'javaws.exe' without validating command-line parameters. Despite the absence of documentation, a researcher was about to figure out that Sun removed the code to run javaws.exe from the Java plugin. The about-face by Sun is another sign that some big vendors still struggle to understand the importance of working closely with white hat researchers to understand the implications of certain vulnerabilities. In this case, Google's Tavis Ormandy was forced to use the full-disclosure weapon to force the vendor into a proper response."Read more of this story at Slashdot.
-
Microsoft Refuses To Patch Rootkit-Compromised XP Machines
Posted: April 15th, 2010, 8:48pm CEST by timothy
Tags: security
Barence writes "Microsoft has revealed that its latest round of patches won't install on XP machines if they're infected with a rootkit. In February, a security patch left some XP users complaining of endless reboots and Blue Screens of Death. An investigation followed and Microsoft discovered the problems occurred on machines infected with the Alureon rootkit, which interacted badly with patch KB977165 for the Windows kernel. Now Microsoft is blocking PCs with the rootkit from receiving its new patches. 'This security update includes package-detection logic that prevents the installation of the security update if certain abnormal conditions exist on 32-bit systems,' Microsoft cautions in the patch notes."Read more of this story at Slashdot.
-
Google Says Spam Volumes On the Rise
Posted: April 15th, 2010, 4:59pm CEST by CmdrTaco
Tags: google
alphadogg writes "Despite security researchers' efforts to cut spam down to size, it just keeps growing back. The volume of unsolicited email in the first quarter was around 6 percent higher than a year earlier, according to Google's e-mail filtering division Postini. Security researchers have won a few significant battles against the spammers in the last year, first against those hosting the spammers' control systems, and later against the control systems themselves, but they will have to change tactics again if they want to win the war. In the first half of last year, security researchers concentrated their efforts on identifying the ISPs or hosting companies that allowed command-and-control servers to operate, and shutting these botnet purveyors down. The success of that tactic was short-lived, however."Read more of this story at Slashdot.
-
How To Exploit NULL Pointers
Posted: April 13th, 2010, 11:03pm CEST by kdawson
Tags: programming
An anonymous reader writes "Ever wondered what was so bad about NULL pointer exceptions? An MIT Linux kernel programmer explains how to turn any NULL pointer into a root exploit on Linux. (There was also a previous installment about virtual memory and how to make NULL pointers benign.)"Read more of this story at Slashdot.
-
NSA Develops USB Storage Device Detector
Posted: April 13th, 2010, 10:20pm CEST by kdawson
Tags: security
Hugh Pickens writes "Bob Brewin writes on NextGov that the National Security Agency has developed a software tool that detects thumb drives or other flash media connected to a network. The NSA says the tool, called the USBDetect 3.0 Computer Network Defense Tool, provides 'network administrators and system security officials with an automated capability to detect the introduction of USB storage devices into their networks. This tool closes potential security vulnerabilities; a definite success story in the pursuit of the [Defense Department] and NSA protect information technology system strategic goals.' The tool gathers data from the registry on Microsoft Windows machines (PDF) and reports whether storage devices, such as portable music or video players, external hard drives, flash drives, jump drives, or thumb drives have been connected to the USB port. 'I have a hunch that a bunch of other agencies use the detection software,' writes Brewin."Read more of this story at Slashdot.
-
Please Do Not Change Your Password
Posted: April 13th, 2010, 7:11pm CEST by CmdrTaco
Tags: security
cxbrx writes "Mark Pothier's Boston Globe article, 'Please do not change your password,' covers a paper by Microsoft Researcher Cormac Herley, 'So Long, and No Thanks for the Externalities: the Rational Rejection of Security Advice by Users,' from the 2009 New Security Paradigms Workshop. Herley argues 'that user's rejection of the security advice they receive is entirely rational from an economic perspective.' Herley discusses 'password rules,' 'teaching users to recognize phishing sites by reading URLs,' and 'certificate errors.' Users obviously choose bad passwords, but does password aging actually help? There was some discussion on TechRepublic. I'm especially interested in hearing about studies about password aging."Read more of this story at Slashdot.
-
Apache Foundation Attacked, Passwords Stolen
Posted: April 13th, 2010, 6:27pm CEST by CmdrTaco
Tags: security
Trailrunner7 writes "Combining a cross-site scripting (XSS) vulnerability with a TinyURL redirect, hackers successfully broke into the infrastructure for the open-source Apache Foundation in what is being described as a 'direct, targeted attack.' The hackers hit the server hosting the software that Apache.org uses to track issues and requests and stole passwords from all users. The software was hosted on brutus.apache.org, a machine running Ubuntu Linux 8.04 LTS, the group said."Read more of this story at Slashdot.
-
New MacBook Pros Launched
Posted: April 13th, 2010, 5:11pm CEST by CmdrTaco
Tags: macbook
Art Vanderlay writes "Apple's new MacBook lineup has launched with a refresh to the MacBook, MacBook Pro, and MacBook Air models. As expected, the MacBook and MacBook Air both feature Core 2 Duo processors, as does the 13. The 15 and 17 models come with a choice of i5 or i7. Memory is 4GB across the board, with an optional upgrade. Additionally, the new line may include three different types of screen options: Glossy, High Resolution Glossy, and High Resolution Glossy with Anti-Glare. A second person familiar with the matter adds that at least some models will support 512GB of Solid State Drive (Flash) storage."Read more of this story at Slashdot.
-
The 1 Terabyte SSD Arrives
Posted: April 13th, 2010, 3:04pm CEST by CmdrTaco
Tags: storage
An anonymous reader writes "Over recent years Solid State Drives (SSDs) have moved from luxury to affordable additions to one's PC, but mechanical hard drives are still king when it comes to capacity. That was until the revamped Colossus LT series Solid State Drive came along this week. With up to 1TB, the drive offers offers massive storage capacities of the level normally not seen in SSDs. While 1TB of SSD space hits right at the heart of the traditional hard disk market, it comes at a high price — at around $4,000 for the 1TB model, these drives are in the realm of aspirational rather than practical."Read more of this story at Slashdot.
-
Dirty Duty On the Front Lines of IT
Posted: April 12th, 2010, 5:50pm CEST by CmdrTaco
Tags: humor
snydeq writes "Jobs may be scarce in today's economy, but there's no shortage of nasty IT work — as the third annual installment of InfoWorld's Dirty IT Jobs series demonstrates. From the payroll cop to the coolant jockey to the network sherpa who has to squeeze into rodent-filled spaces and deal with penny-pinching clients, these seven jobs provide further proof that dirty duty abounds on the front lines of IT."Read more of this story at Slashdot.
-
Review of Adobe Creative Suite 5
Posted: April 12th, 2010, 3:40pm CEST by CmdrTaco
Tags: Software
Barence writes "Adobe today updated its Creative Suite software to version 5, and PC Pro has an absolutely massive collection of reviews. Along with an overview of the entire suite, from Design to Web to Production bundles, every individual component gets the full in-depth treatment. It includes video demonstrations of Photoshop CS5's fabulous Content-Aware fill trick and new Puppet Warp function; a long-awaited step up to 64-bit for Premiere Pro CS5; and big updates to Dreamweaver CS5, After Effects CS5, and the rest."Read more of this story at Slashdot.
-
What Advice For a Single Parent As Server Admin?
Posted: April 11th, 2010, 8:29pm CEST by timothy
Tags: windows
Dragon_Eater, with "lots of experience setting up PCs and a passable knowledge of Linux but severely lacking in the server/client department," writes with a situation that probably faces a lot of parents: I want to set up three kids, 12, 14, and 15, with newer computers so they will stop fighting for time on the one ten-year-old Dell they share now. I can get the individual computers and a server put together without any problems, but the computer-handicapped single parent needs to be able to do the following via an simple application/web page: View client computer status, On/off, sleeping etc.; Deny Internet access, not LAN, just the web; Schedule time usage of computer, ex. 7 am to 10 pm on school nights etc.; Force log-out and/or shutdown of clients, for grounding purposes; and Apply some kind of firewall filter for blocking undesired web content. And as the administrator for this network I would like the following options: Remote virus scanning of client machines, or scheduled task; Some kind of hardware monitor, high temp / fan speed low etc.; and Email alerts for various log files / alarms. Given the lists above I am thinking about a Linux-based router/server machine and running Windows on the clients for game compatibility. I also know that a server and network boot client is possible but not sure where to start on that one."Read more of this story at Slashdot.
-
Why Responsible Vulnerability Disclosure Is Painful and Inefficient
Posted: April 11th, 2010, 5:20pm CEST by Soulskill
Tags: bug
A recent rant up at Attrition.org highlights problems with the responsible disclosure of security issues. While some vendors are happy to do their own research and patch reported problems, others drag their feet and make unreasonable demands on a researcher's time and effort, making anonymous public disclosure an ever-more-tempting option. Quoting: "After a couple hours of poking, I found a huge unauthenticated confidentiality hole. Once the euphoria wore off, I realized I had a big problem on my hands. I had to tell my employer's app owners and we had to assess risk and make a decision on what to do about it. After some quick meetings with stakeholders, we decided to severely limit access to the thing while we worked with the vendor. The vendor refused to acknowledge it was a security issue. Odd, considering most everyone who sees the issue unmistakably agrees that it is not acceptable. Now I'm forced to play hardball, yet nobody wants to fully-disclose and destroy relations with this vendor, whose software is somewhat relied on. Meanwhile, I know there are hundreds of institutions, small and large, using this software who have no idea that it has flawed security and who would probably not find the risk acceptable. What can I do? Nothing. Oh well, sucks to be them. ... I've had a vendor tell me to put a webapp firewall in front of their software. Did they offer to pay for it? No. That would be like Toyota telling its customers to buy ejector seats (unsubsidized ejector seats, that is) to resolve the accelerator problem in their vehicles. I've had other vendors demand I spend time helping them understand the issue, basically consulting for free for them. Have you ever knocked on a neighbor's door to tell them they left their headlights on? Did they then require you to cook them dinner? Exactly..."Read more of this story at Slashdot.
-
Firefox Lorentz Keeps Plugin Crashes Under Control
Posted: April 10th, 2010, 5:32am CEST by timothy
Tags: firefox
pastababa writes "A beta of the Firefox Lorentz project is now available for download and public testing. Eming reports Firefox 'Lorentz' provides uninterrupted browsing for Windows and Linux users when there is a crash in plugins. Plugins run in a separate process from the browser. If a plugin crashes it will not crash the browser, and unresponsive plugins are automatically restarted. The process-isolation feature has been in Google's Chrome from the beginning. Chrome sandboxes individual tabs, and the crash of one tab does not affect the running of the rest of Chrome browser. Firefox currently isolates only Adobe Flash, Apple Quicktime, and Microsoft Silverlight, but will eventually isolate all plugins running on a page. Mozilla encourages users to test Firefox 'Lorentz' on their favorite websites. Users who install Firefox 'Lorentz' will eventually be automatically updated to a future version of Firefox 3.6 in which this feature is included."Read more of this story at Slashdot.
-
Serious New Java Flaw Affects All Browsers
Posted: April 9th, 2010, 11:20pm CEST by Soulskill
Tags: java
Trailrunner7 writes "There is a serious vulnerability in Java that makes all current browsers vulnerable to simple Web-based attacks that could lead to a complete compromise of the affected system. Two separate researchers released information on the vulnerability on Friday, saying that it has been present in Java for years. The problem lies in the Java Web Start framework, a technology that Sun Microsystems developed to enable the simplified deployment of Java applications. In essence, the JavaWS technology fails to validate parameters passed to it from the command line, and attackers can control those parameters using specific HTML tags on a Web page, researcher Ruben Santamarta said in an advisory posted Friday morning."Read more of this story at Slashdot.
-
Spamming a Judge Is Contempt of Court
Posted: April 9th, 2010, 7:51pm CEST by samzenpus
Tags: spam
eldavojohn writes "TV pitchman Kevin Trudeau was sentenced to 30 days in jail because he urged his fans and followers to spam a judge. Apparently the judge (who was deluged with emails) decided that this was an act of contempt of court on the court's 'virtual presence' since nothing happened while the court was in session in regards to Trudeau's courtroom behavior. US Marshals are now trudging through those emails to decide if any are threatening."Read more of this story at Slashdot.
-
How To Find Bad Programmers
Posted: April 9th, 2010, 6:16pm CEST by samzenpus
Tags: programming
AmberShah writes "The job post is your potential programmer's first impression of your company, so make it count with these offputting features. There are plenty of articles about recruiting great developers, but what if you are only interested in the crappy ones?" I think much of the industry is already following these guidelines.Read more of this story at Slashdot.
-
ISO 9001-Compliant Document Control?
Posted: April 9th, 2010, 5:36pm CEST by kdawson
Tags: IT
SmoothBreaker writes "Coming into a new company, I have been tasked with sourcing Document Control software to meet ISO 9001 standards. From everything I can find, ISO places no requirements on the software itself, aside from maintaining control of documentation and process. This was discussed eleven years ago. I'd like software that allows intuitive use for our less savvy users, and in a perfect world, graphical access to previous revisions of a document. I've used Microsoft's SharePoint, which the higher-ups like simply because it's Microsoft, but thankfully they trust their Tech Department to find the cream of the crop. What experience do you have with this kind of software, what would you recommend using, and what should I avoid?"Read more of this story at Slashdot.
-
Warhammer Online Users Repeatedly Overbilled
Posted: April 9th, 2010, 5:53am CEST by Soulskill
Tags: bug
TheSpoom writes "A screw-up in EA's Warhammer Online billing system has resulted in many players being charged upwards of 22 times for a one-month subscription, filling bank accounts with overdraft fees and the Warhammer forums with very angry players, who are discussing the issue quite vocally. EA has said that refunds are in progress and that '[they] anticipate that once the charges have been reversed, any fees that have been incurred should be refunded as well.' They haven't specifically promised to refund overdraft charges, only to ask customers' banks to refund them once the actual charges are refunded. They seem to be assuming banks will have no problem with this."Read more of this story at Slashdot.
-
GNOME 2.30, End of the (2.x) Line
Posted: April 9th, 2010, 12:39am CEST by timothy
Tags: gnome
stovicek writes "GNOME 2.30 was originally intended to coincide with GNOME 3.0 — a massive cleanup and rethinking of the popular desktop. However, GNOME 3.0 is delayed for at least another release, which leaves GNOME 2.30 as most likely the last version in a series stretching back almost a decade. [...] 2.30 will probably be the final version of the 2.0 series. For those who were around for GNOME 2.0 back in 2000, the 2.30 release stands as evidence of how far GNOME in general and the free desktop in particular have come in the last decade in usability and design. If you do a search for images of early GNOME releases and compare the results with 2.30, you can have no doubt that, although GNOME sometimes tends to over-simplify, its improvements over the last decade remain unmistakable."Read more of this story at Slashdot.
-
Proposal To Limit ISP Contact Data Draws Fire
Posted: April 8th, 2010, 11:00pm CEST by timothy
Tags: privacy
An anonymous reader writes "A proposal to let Internet service providers conceal the contact information for their business customers is drawing fire from a number of experts in the security community, who say the change will make it harder to mitigate the threat from spam and malicious software, according to a story at Krebsonsecurity.com. From the piece: 'The American Registry for Internet Numbers (ARIN) — one of five regional registries worldwide that is responsible for allocating blocks of Internet addresses — later this month will consider a proposal to ease rules that require ISPs to publish address and phone number information for their business customers. Proponents of the plan couch it in terms of property rights and privacy, but critics say it will only lead to litigation and confusion, while aiding spammers and other shady actors who obtain blocks of addresses by posing as legitimate businesses.'"Read more of this story at Slashdot.
-
Geohot Brings Other OS Support To PS3 With Custom Firmware
Posted: April 8th, 2010, 12:34pm CEST by Soulskill
Tags: os
suraj.sun tips news that hacker Geohot is following through on his promise to fight Sony's removal of the "Install Other OS" feature on the PS3. He posted a video of the work he's done so far that shows a PS3 console booting into Linux. Quoting Engadget: "While it's not available to the public just yet, Geohot's 3.21OO custom firmware will apparently be simple to install and, as you can see in the video after the break, it works just as you'd expect and simply restores the 'other OS' option to its previous place. Geohot even says that the custom firmware might actually enable the other OS feature on the PS3 Slim, but he hasn't yet had a chance to try it out."Read more of this story at Slashdot.
-
How Did Wikileaks Do It?
Posted: April 7th, 2010, 8:58pm CEST by timothy
Tags: encryption
grassy_knoll writes "Related to the Wikileaks video recently released and discussed here, the NY Times reports: 'Somehow — it will not say how — WikiLeaks found the necessary computer time to decrypt a graphic video, released Monday, of a United States Army assault in Baghdad in 2007 that left 12 people dead, including two employees of the news agency Reuters. The video has been viewed more than two million times on YouTube, and has been replayed hundreds of times in television news reports.' The article is light on details; what encryption algorithm was used? Was this a brute force attack? Did someone pass the decryption keys to Wikileaks along with the video? Something else?"Read more of this story at Slashdot.
-
Researcher Releases Hardened OS "Qubes"; Xen Hits 4.0
Posted: April 7th, 2010, 8:11pm CEST by timothy
Tags: os
Trailrunner7 writes "Joanna Rutkowska, a security researcher known for her work on virtualization security and low-level rootkits, has released a new open-source operating system meant to provide isolation of the OS's components for better security. The OS, called Qubes, is based on Xen, X and Linux, and is in a basic, alpha stage right now. Qubes relies on virtualization to separate applications running on the OS and also places many of the system-level components in sandboxes to prevent them from affecting each other. 'Qubes lets the user define many security domains implemented as lightweight virtual machines (VMs), or 'AppVMs.' E.g. users can have 'personal,' 'work,' 'shopping,' 'bank,' and 'random' AppVMs and can use the applications from within those VMs just like if they were executing on the local machine, but at the same time they are well isolated from each other. Qubes supports secure copy-and-paste and file sharing between the AppVMs, of course.'" Xen's also just reached 4.0; some details below.Read more of this story at Slashdot.
-
US Most Vulnerable To Cyberattack?
Posted: April 7th, 2010, 5:46pm CEST by CmdrTaco
Tags: security
alphadogg writes "Several nations, most prominently Russia, the People's Republic of China and North Korea, are already assembling cyber armies and attack weapons that could be used to attack other nations. Given that the United States is heavily dependent on technology for everything from computer-based banking to supply-chain tracking and air-traffic control, it's particularly vulnerable to the denial-of-service attacks, electronic jamming, data destruction and software-based disinformation tricks likely in a cyberattack. Here's what ex-presidential adviser Richard Clarke, who is releasing a new book called Cyber War, and others are saying needs to be done to keep cyberwars from escalating into full-scale combat."Read more of this story at Slashdot.
-
A Year's Further Research On an Espionage Network
Posted: April 6th, 2010, 8:02pm CEST by kdawson
Tags: botnet
Mortimer.CA writes "Last year researchers discovered a giant electronic spying operation they dubbed GhostNet. Now, after a further year's worth of research, Infowar Monitor has released a new report. The report (Scribbed PDF) documents a complex ecosystem of cyber espionage that systematically targeted and compromised computer systems in India, the Offices of the Dalai Lama, the United Nations, and several other countries. While the servers are in China, the report's authors say that there is 'no evidence in this report of the involvement of the People's Republic of China or any other government in the shadow network.' Furthermore, the 'intruders even stole documents related to the travel of NATO forces in Afghanistan, illustrating that even though the Indian government was the primary target of the attacks, one gap in computer security can leave many nations exposed.'"Read more of this story at Slashdot.
-
No JavaScript Needed For New Adobe Exploits
Posted: April 6th, 2010, 5:52pm CEST by CmdrTaco
Tags: security
bl8n8r writes "More woes for Adobe as a security firm creates a proof-of-concept attack that injects malicious code as part of the update process. The user only needs to click a dialog box to execute the code and no JavaScript is needed to launch the exploit. The exploit affects Foxit as well as Adobe Acrobat software. This exploit is made possible through the host software allowing execution of system binaries. Not clear if it's multi-platform, but seems plausible."Read more of this story at Slashdot.
-
Compliance Is Wasted Money, Study Finds
Posted: April 5th, 2010, 10:12pm CEST by Soulskill
Tags: security
Trailrunner7 writes "Enterprises are spending huge amounts of money on compliance programs related to PCI-DSS, HIPAA and other regulations, but those funds may be misdirected in light of the priorities of most information security programs, a new study has found. A paper by Forrester Research, commissioned by Microsoft and RSA, the security division of EMC, found that even though corporate intellectual property comprises 62 percent of a given company's data assets, most of the focus of their security programs is on compliance with various regulations. The study found that enterprise security managers know what their companies' true data assets are, but find that their security programs are driven mainly by compliance, rather than protection (PDF)."Read more of this story at Slashdot.
-
Naming and Shaming Toxic Web Apps
Posted: April 5th, 2010, 8:55pm CEST by Soulskill
Tags: Software
itwbennett writes "Stanford Law School has released a wiki called WhatApp?, where users can rate all manner of web apps, browsers, mobile platforms, mobile apps, and social network apps on their security, privacy, and openness. Currently, the wiki 'lists some 200+ apps, but most of them have not been reviewed yet. So they need a lot of help,' writes blogger Dan Tynan. 'To review an app you select it from the list, then fill out a 9-question form rating its privacy, security, and openness, ranging from 5 (very private, secure, and open) to 1 (a steaming pile of vulnerabilities and violations).'"Read more of this story at Slashdot.
-
2010 Salary Survey Highlights IT Woes
Posted: April 5th, 2010, 8:10pm CEST by Soulskill
Tags: business
CWmike writes "Trapped between flat salaries and ever-increasing workloads, IT professionals are about to explode. That's the top takeaway from Computerworld's 2010 survey of nearly 5,000 IT workers. 'Bonuses and benefits are way down, and workloads and work hours have increased. Meanwhile, salaries are stagnant (rising just a microscopic 0.7% on average), and — not surprisingly — satisfaction is on the wane.' Another finding of note is the shrinking female IT workforce. Have a look-see at how IT fared in your neck of the woods with this smart look-up tool."Read more of this story at Slashdot.
-
Cold War Warrantless Wiretapping
Posted: April 4th, 2010, 2:18pm CEST by kdawson
Tags: privacy
somanyrobots writes "President Gerald Ford secretly authorized the use of warrantless domestic wiretaps for foreign intelligence and counterintelligence purposes soon after coming into office, according to a declassified document. The Dec. 19, 1974, White House memorandum, marked Top Secret / Exclusively Eyes Only and signed by Ford, gave then-Attorney General William B. Saxbe and his successors in office authorization 'to approve, without prior judicial warrants, specific electronic surveillance within the United States which may be requested by the Director of the Federal Bureau of Investigation.'" And reader jlaprise1 adds, "My research [from 2009] makes the news! President Ford authorized warrantless wiretaps in December 1976 and laid the foundation (PDF) for US telecommunications security policy."Read more of this story at Slashdot.
-
Seeking Competitive Advantage, For Malware
Posted: April 3rd, 2010, 1:14am CEST by timothy
Tags: botnet
jc_chgo writes "Brian Krebs over at the must-read KrebsOnSecurity.com writes about the rivalry between two competing authors of nasty credential-stealing malware. The newer (SpyEye) can remove the older (Zeus) on any system it infects. Meanwhile, Zeus is so successful prices have gone way up for the new version. These 'crimeware kits' are freely available for purchase, and have enabled millions of dollars in thefts. The buyers of the kits prey primarily on small businesses by using wire transfers out of bank accounts. This is a problem that is only going to get bigger over time."Read more of this story at Slashdot.
-
US One Step Closer To Electric Grid Cyberguards
Posted: April 2nd, 2010, 9:33pm CEST by Soulskill
Tags: power
coondoggie writes "The US Department of Energy this week officially opened up the bidding for a National Electric Sector Cyber Security Organization that would protect the nation's electrical grid from cyber attacks. According to the DOE, the agency has set an aggressive goal to meet the nation's need for a reliable, efficient, and resilient electric power grid, as well as improved accessibility to a variety of energy sources for generation. In order to achieve this, an independent organization is needed (PDF) to provide executive leadership to facilitate research, development, and deployment priorities; identify and disseminate best cybersecurity practices; organize the collection, analysis, monitoring, and dissemination of infrastructure vulnerabilities and threats; and enhance cybersecurity of the electric grid, including control and IT systems."Read more of this story at Slashdot.
-
US Changes How Air Travelers Are Screened
Posted: April 2nd, 2010, 5:13pm CEST by kdawson
Tags: government
Hugh Pickens writes "The Washington Post reports that the Obama administration is abandoning its policy of using nationality alone to determine which US-bound international air travelers should be subject to additional screening and will instead select passengers based on possible matches to intelligence information, including physical descriptions or a particular travel pattern. Under the new system, screeners will stop passengers for additional security if they match certain pieces of known intelligence. The system will be 'much more intel-based,' a senior administration official says, as opposed to brute force. For example if US intelligence authorities learned about a terrorism suspect from Asia who had recently traveled to the Middle East, and they knew the suspect's approximate age but not name or passport number, those fragments would be entered into a database, shared with commercial airline screeners abroad, and screeners would be instructed to look for people with those traits and to pull them aside for extra searches. Administration officials have said that, in hindsight, the central failure in the attempted bombing of an Amsterdam-to-Detroit flight on Christmas Day involved inadequate sharing of information." In other TSA-related news, CNN takes a look at the full-body scanners that are beginning to be deployed in the US and elsewhere, concluding that they are good at finding concealed drugs but haven't found much that could bring down an airplane. John Perry Barlow is quoted: "Every time technology makes another leap forward, we have to reclaim the Fourth Amendment, and often we have to reclaim the entire Bill of Rights, because technology gives [the authorities] powers that were not envisioned by the Founding Fathers."Read more of this story at Slashdot.
-
Stalker Jailed For Planting Child Porn On a PC
Posted: April 2nd, 2010, 4:29pm CEST by samzenpus
Tags: crime
An anonymous reader writes "An elaborate scheme to get the husband of a co-worker with whom he was obsessed jailed backfired on Ilkka Karttunen, 48, from Essex in the UK. His plan was to get the husband arrested so that he could have a go at a relationship with the woman. To do this he broke into the couple's home while they were sleeping, used their family computer to download child pornography, and then removed the hard drive and mailed it anonymously to the police, along with a note that identified the owner."Read more of this story at Slashdot.
-
Microsoft Fuzzing Botnet Finds 1,800 Office Bugs
Posted: April 2nd, 2010, 11:09am CEST by timothy
Tags: programming
CWmike writes "Microsoft uncovered more than 1,800 bugs in Office 2010 by tapping into the unused computing horsepower of idling PCs, a company security engineer said on Wednesday. Office developers found the bugs by running millions of 'fuzzing' tests, a practice employed by both software developers and security researchers, that searches for flaws by inserting data into file format parsers to see where programs fail by crashing. 'We found and fixed about 1,800 bugs in Office 2010's code,' said Tom Gallagher, senior security test lead with Microsoft's Trustworthy Computing group, who last week co-hosted a presentation on Microsoft's fuzzing efforts at the CanSecWest security conference. 'While a large number, it's important to note that that doesn't mean we found 1,800 security issues. We also want to fix things that are not security concerns.'"Read more of this story at Slashdot.
-
Office Guardian Angel Worse Than Clippy
Posted: April 1st, 2010, 2:27am CEST by samzenpus
Tags: microsoft
ZWilder writes "Remember 'Clippy', the annoying anthropomorphic paper clip foisted upon unsuspecting users of Office? Well Microsoft has taken the concept behind Clippy and 'turned the dial up to 11' with its new, even more intrusive animated life-coach, known as 'Guardian Angel.' Patented in 2006, Guardian Angel is 'an intelligent personalized agent' that 'monitors and evaluates a user's environment to assist in decision-making processes on behalf of the user.' Like a manlier Fairy Godmother. Or a similarly omniscient HAL from '2001: A Space Oddysey.'"Read more of this story at Slashdot.