Read more of this story at Slashdot.
Feeds
34755 items (30242 unread) in 5 feeds
OpenSource
(5770 unread)
-
SourceForge.net: Front page news
(802 unread)
-
Slashdot: IT (4968 unread)
Security
(11377 unread)
-
Digg / Security (11377 unread)
Linux
(13095 unread)
-
-
Slashdot: Linux (1661 unread)
Items by kdawson
Slashdot: IT
-
Browser Exploit Kits Using Built-In Java Feature
Posted: January 10th, 2011, 5:29pm CET by kdawson
Tags: security
tsu doh nimh writes "Security experts from several different organizations are tracking an increase in Windows malware compromises via Java, although not from a vulnerability in Windows itself: the threat comes from a feature of Java that prompts the user to download and run a Java applet. Kaspersky said it saw a huge uptick in PCs compromised by Java exploits in December, but that the biggest change was the use of this Java feature for social engineering. Brian Krebs writes about this trend, and looks at two new exploit packs that are powered mainly by Java flaws, including one pack that advertises this feature as an exploit that works on all Java versions." -
Disempowering the Singular Sysadmin?
Posted: January 10th, 2011, 4:39pm CET by kdawson
Tags: IT
An anonymous reader writes "Practically every computer system appears to be at the mercy of at least one individual who holds root (or whatever other superuser identity can destroy or subvert that system). However, making a system require multiple individuals for any root operation (think of the classic two-key process to launch a nuke) has shortcomings: simple operations sometimes require root, and would be enormously cumbersome if they needed a consensus of administrators to execute. There is the idea of a Distributed Administration Network, which is like a cluster of independently administered servers, but this is a limited case for deployment of certain applications. And besides, DAN appears still to be vaporware. Are there more sweeping yet practical solutions out there for avoiding the weakness of a singular empowered superuser?"Read more of this story at Slashdot.
-
FBI Alleged To Have Backdoored OpenBSD's IPSEC Stack
Posted: December 15th, 2010, 1:36am CET by kdawson
Tags: encryption
Aggrajag and Mortimer.CA, among others, wrote to inform us that Theo de Raadt has made public an email sent to him by Gregory Perry, who worked on the OpenBSD crypto framework a decade ago. The claim is that the FBI paid contractors to insert backdoors into OpenBSD's IPSEC stack. Mr. Perry is coming forward now that his NDA with the FBI has expired. The code was originally added ten years ago, and over that time has changed quite a bit, "so it is unclear what the true impact of these allegations are" says Mr. de Raadt. He added: "Since we had the first IPSEC stack available for free, large parts of the code are now found in many other projects/products." (Freeswan and Openswan are not based on this code.)Read more of this story at Slashdot.
-
Apple Quietly Drops iOS Jailbreak Detection API
Posted: December 11th, 2010, 12:26am CET by kdawson
Tags: iphone
bednarz writes "Without explanation, Apple has disabled a jailbreak detection API in iOS, less than six months after introducing it. Device management vendors say the reasons for the decision are a mystery, but insist they can use alternatives to discover if an iPhone, iPod touch, or iPad has been modified so it can load and alter applications outside of Apple's iTunes-based App Store."Read more of this story at Slashdot.
-
Tobacco Virus Could Boost Li Batteries
Posted: December 10th, 2010, 6:01pm CET by kdawson
Tags: bug
siliconbits alerts us to the possible use of one of the world's most destructive naturally occurring scourges, the tobacco mosaic virus, to boost the capacity of lithium ion batteries by 10 times. It seems the virus can be made to attach itself to the electrodes in a lithium cell perpendicularly, increasing the surface area of the electrode and greatly improving the battery's capacity to store energy. PhysOrg has some more detail on virus-enhanced batteries. Four years ago we discussed the use of the tobacco mosaic virus to enable fast-switching transistors.Read more of this story at Slashdot.
-
Remote Exim Exploit In the Wild
Posted: December 10th, 2010, 5:11pm CET by kdawson
Tags: security
An anonymous reader sends word of a remote exploit in the wild against the Exim mail agent. The news comes on the exim mailing list, where a user posted that he had his exim install hacked via remote exploit giving the attacker the privilege of the mailnull user, which can lead to other possible attacks. A note up at the Internet Storm Center reminds exim users how to set up to run in unprivileged mode, and a commenter includes recompile instructions for Debian exim for added safety. The security press hasn't picked up on this story so far.Read more of this story at Slashdot.
-
DNSSEC Comes To .Net Zone Today
Posted: December 10th, 2010, 3:37pm CET by kdawson
Tags: networking
wiredmikey sends news that as of today VeriSign has enabled DNSSEC on the .net zone. This is one milestone in a years-long process of securing the DNS against cache poisoning and other attacks. Next step will be for VeriSign to sign the .com root early next year."Having DNSSEC enabled for .net domains... [is] important as it represents one of the most critical implementations of DNSSEC technology, since .net serves as the underpinning for many critical Internet functions. The largest zone to be DNSSEC enabled to date, .net currently has more than 13 million... domain name registrations worldwide."Read more of this story at Slashdot.
-
Iron-Eating Bug Is Gobbling Up the Titanic
Posted: December 10th, 2010, 2:50pm CET by kdawson
Tags: bug
gambit3 writes "A newly discovered microbe dubbed Halomonas titanicae is chewing its way through the wreck of the Titanic and leaving little behind except a fine dust, researchers report in the International Journal of Systematic and Evolutionary Microbiology. 'In 1995, I was predicting that Titanic had another 30 years,' said Henrietta Mann, a civil engineering adjunct professor at Dalhousie University in Halifax, Nova Scotia. 'It's deteriorating much faster than that now.'"Read more of this story at Slashdot.
-
When Your Company Remote-Wipes Your Personal Phone
Posted: November 23rd, 2010, 11:33pm CET by kdawson
Tags: iphone
Xenographic writes "NPR has a story about someone whose personal iPhone got remotely wiped by their employer. It was actually a mistake, but it was something of a surprise because they didn't believe they had given their employer any kind of access to do that. This may already be very familiar to Microsoft Exchange admins, but the problem was her iPhone's integration with MS Exchange automatically gives the server admin access to do remote wipes. All you have to do is configure the phone to receive email from an MS Exchange server and the server admin can wipe your phone at will. The phone wasn't bricked, even though absolutely all of its data was wiped, because the data could be restored from backup, assuming that someone had remembered to make one. But this also works on other devices like iPads, Blackberry phones, and other smartphones that integrate with MS Exchange. So if you read your work email on your personal phone or tablet, you might want to make sure that you keep backups, just in case."Read more of this story at Slashdot.
-
Rootkit In a Network Card Demonstrated
Posted: November 23rd, 2010, 9:11pm CET by kdawson
Tags: security
KindMind notes coverage in The Register on a researcher who has developed a firmware-based rootkit that resides in a network card. Here is the developer's blog entry. "Guillaume Delugré, a reverse engineer at French security firm Sogeti ESEC, was able to develop proof-of-concept code after studying the firmware from Broadcom Ethernet NetExtreme PCI Ethernet cards... Using the knowledge gained from this process, Delugré was able to develop custom firmware code and flash the device so that his proof-of-concept code ran on the CPU of the network card."Read more of this story at Slashdot.