An anonymous reader writes "Google on Friday announced yet another security improvement for Chrome 25. In addition to killing silent extension installation, the omnibox in Google's browser will send all searches over a Secure Sockets Layer (SSL) connection. Chrome already does this for users who are signed in to Google: when they search from the address bar, their queries are sent over HTTPS. As of Chrome 25, however, the same will happen for users who aren't signed in to Google."

msm1267 writes "Oracle's long security nightmare with Java just gets worse. A post to Full Disclosure this morning from a security researcher indicated that two new sandbox bypass vulnerabilities have been discovered and reported to Oracle, along with working exploit code. Oracle released Java 7u11 last Sunday and said it fixed a pair of vulnerabilities being exploited by all the major exploit kits. Turns out one of those two bugs wasn't completely patched. Today's bugs are apparently not related to the previous security issues."

An anonymous reader writes "Wired reports on a research paper from Google employees about the future of authentication on the web. 'Along with many in the industry, we feel passwords and simple bearer tokens such as cookies are no longer sufficient to keep users safe,' the authors write. Their plan involves authenticating just once, to a single device, and then using that to unlock all of your other accounts. "We'd like your smartphone or smartcard-embedded finger ring to authorize a new computer via a tap on the computer, even in situations in which your phone might be without cellular connectivity." Recognizing that this isn't something they can accomplish on their own, they've gone ahead and created a device-based authentication protocol that is 'independent of Google, requires no special software to work — aside from a web browser that supports the login standard — and which prevents web sites from using this technology to track users.'"

An anonymous reader writes "Dozens of volunteers who anonymously donated their genomic data to a public database for medical research have been identified by a team led by Yaniv Erlich, a former computer security researcher turned geneticist. Erlich's team matched Y chromosomal markers in genomes compiled by the 1000 Genomes Project with non-anonymous genomic databases, for example some assembled from contributions by family tree enthusiasts (abstract). After finding a match on a presumed relative of the study participant, the researchers pieced together the relative's family tree through search engines and the like, until they were able to identify the participant based on gender, age, place of birth, and other supposedly 'non-identifying' information associated with the genome. The names of the identified participants have not been released."

McGruber writes "The Transportation Security Administration (TSA) has ended a contract with Rapiscan, a unit of OSI Systems Inc., manufacturer of about half of all of the controversial full-body scanners used on air passengers. TSA officials claim that Rapiscan failed to deliver software that would protect the privacy of passengers, but the contract termination happened immediately after the TSA finally got around to studying the health effects of the scanners, and Congress had a hearing on TSA's 'Scanner Shuffle'."

redletterdave writes "For the second time in a row, Microsoft's Security Essentials failed to earn certification from AV-Test, the independent German testing lab best known for evaluating the effectiveness of antivirus software. Out of 25 different security programs tested by AV-Test, including software from McAfee, Norman, Kaspersky, and others, Microsoft's Security Essentials was just one out of three that failed to gain certification. These results are noteworthy because Microsoft Security Essentials is currently (as of December) the most popular security suite in North America and the world."

Qedward writes with this except from Computerworld UK: "Germany should change a law to enable public administrations to make their software available as free and open source, a German parliamentary committee has advised. German public administrations currently are not allowed to give away goods, including software, said Jimmy Schulz, a member of Parliament and chairman of the Interoperability, Standards and Free Software Project Group. The current law prohibits governments from being part of the development process in the free software community, he said. 'This is a clear disadvantage because it cuts off all benefits obtained from free software, such as being cost-efficient and state-of-the-art,' he said. Besides a recommendation that the government should explore whether the law can be changed for software, the group also called for the use of open standards in order to make sure that everybody can have access to important information, Schulz said. 'We also called for public administrations in general to make sure that new software is created as platform independent as possible,' he added. While the project group is not in favour of giving priority to one type of software over another, it said in its recommendation to the Parliament earlier this week that free and open source software could be a viable alternative to proprietary software." I think a fair rule is that, barring extraordinary and demonstrated need, all tax dollars for software should go only for the development of software for which source is available gratis to all taxpayers, and that secret-source software makers are free to change to fit this requirement any time they'd like to have their software considered for a bid.

Rikki Endsley has been Community Manager for USENIX since September, 2011. She also edits their magazine, ;login:, writes for publications ranging from Linux.com to Network World, and is a long-distance runner to boot. But this interview concentrates on USENIX, a worthy organization that does a great job of helping its members (and the entire Unix/Linux community) stay up to date technically and, with its job board, keep USENIX members employed. Toward the end of the conversation, Rikki mentions some of the intangible but valuable benefits people get when they attend USENIX events. (Remember: If you don't have time to watch the video, can't see the video or just don't like video, you can click on the "Show/Hide Transcript" link and read a text version of the video.)

kthreadd writes "The Red Hat Enterprise Linux 5 derivative CentOS version 5.9 has been released just 10 days after its upstream provider. According to the release notes a number of changes have been made. New packages available in CentOS 5.9 includes for example OpenJDK 7 and Rsyslog 5. Several drivers have also been updated in the kernel which has been updated to version 2.6.18-348, including support for Microsoft's virtualization environment Hyper-V." CentOS has been plugging away now for nearly 10 years.

mask.of.sanity writes "The Department of Homeland Security has taken charge of pushing medical device manufacturers to fix vulnerable medical software and devices after researchers popped yet another piece of hospital hardware. It comes after the agency pushed Philips to move to fix critical vulnerabilities found in its popular medical management platform that is used in a host of services including assisting surgeries and generating patient reports. To date, no agency has taken point on forcing the medical manufacturers to improve the information security profile of their products, with the FDA even dubbing such a risk unrealistic (PDF)."

chicksdaddy writes "Researchers at RSA say that a new phishing toolkit allows attackers to put a velvet rope around scam web pages – bouncing all but the intended victims. The new toolkit, dubbed 'Bouncer,' was discovered in an analysis of attacks on financial institutions in South Africa, Australia and Malaysia in recent weeks. It allows attackers to generate a unique ID for each intended victim, then embed that in a URL that is sent to the victim. Outsiders attempting to access the phishing page are redirected to a '404 page not found' error message. Other phishing kits have used IP address blacklists to block anti malware companies from viewing their malicious pages, but this is the first known use of whitelisting, RSA said. The phishing attacks that RSA technicians discovered that used the Bouncer kit were designed to harvest login credentials from financial services firms. The whitelisting feature may well work, especially given the volume of potential phishing pages that security companies review each day. Getting a 404 message may be enough to get a forensic investigator or security researcher to move on to the next phishing site, rather than investigating."

tsamsoniw writes "Mere days after Oracle rolled out a fix for the latest Java zero-day vulnerabilities, an admin for an Underweb hacker forum put code for a purportedly new Java exploit up for sale for $5,000. Though unconfirmed, it's certainly plausible that the latest Java patch didn't do the job, based on an analysis by the OpenJDK community. Maybe it's high time for Oracle to fix Java to better protect both its enterprise customers and the millions of home users it picked up when it acquired Sun."

New submitter kju writes "The security blog of Verizon has the story of an investigation into unauthorized VPN access from China which led to unexpected findings. Investigators found invoices from a Chinese contractor who had actually done the work of the employee, who spent the day watching cat videos and visiting eBay and Facebook. The man had Fedexed his RSA token to the contractor and paid only about 1/5th of his income for the contracting service. Because he provided clean code on time, he was noted in his performance reviews to be the best programmer in the building. According to the article, the man had similar scams running with other companies."

angry tapir writes "Two U.S. power companies have reported infections of malware during the past three months, with the bad software apparently brought in through tainted USB drives, according to the U.S. Department of Homeland Security's Industrial Control Systems Cyber Emergency Response Team (ICS-CERT). The publication (PDF) did not name the malware discovered. The tainted USB drive came in contact with a 'handful of machines' at the power generation facility and investigators found sophisticated malware on two engineering workstations critical to the operation of the control environment, ICS-CERT said."

tsamsoniw writes "More new tech jobs have emerged since the end of the past recession than during the same recovery timelines following the dot-com bubble burst and the early-1990s recession. What's more, the unemployment rate among technology professionals is now half that of the national average — with especially low unemployment rates for database administrators and network architects. What's not clear, though, is how many unemployed techies aren't being counted because they've abandoned job searches."

chicksdaddy writes "The University of Michigan will be among the first to offer graduate students the opportunity to study the security of advanced medical devices. The course, EECS 598-008 'Medical Device Security' will teach graduate students in UMich's Electrical Engineering and Computer Science program 'the engineering concepts and skills for creating more trustworthy software-based medical devices ranging from pacemakers to radiation planning software to mobile medical apps.' The new course comes amid rapid change in the market for sophisticated medical devices like insulin pumps, respirators and monitoring stations, which increasingly run on versions of the same operating systems that power desktops and servers. In 2011, the U.S. Food and Drug Administration reported that software failures were the root cause of a quarter of all medical device recalls (PDF)."

netbuzz writes "A mysterious GPS-tracking glitch has brought a parade of lost-phone seekers — and police officers — to the front door of a single beleaguered homeowner in Las Vegas. Each of the unexpected visitors – Sprint customers all — has arrived absolutely convinced that the man has their phone. Not so, police confirm. The same thing happened in New Orleans in 2011 and Sprint got sued. Says the Las Vegas man: 'It's very difficult to say, 'I don't have your phone,' in any other way other than, 'I don't have your phone.''"

1sockchuck writes "Jon Karlung believes that data centers shouldn't just be cool – they should look cool, too. His latest approach to futuristic IT is a modular data center designed to look like a space station. Karlung, the CEO of Sweden's Bahnhof, previously built a stylish data center in a former nuclear bunker beneath Stockholm featuring a waterfall, which has been compared to the lair of a James Bond villain. Karlung's new design features IT modules built from bullet-proof steel that attach to an inflatable dome for staff. 'Containers are ugly,' Karlung says. 'I think design is too often neglected in our field of business.'"

Orome1 writes "DefenseCode researchers have uncovered a remote root access vulnerability in the default installation of Linksys routers. They contacted Cisco and shared a detailed vulnerability description along with the PoC exploit for the vulnerability. Cisco claimed that the vulnerability was already fixed in the latest firmware release, which turned out to be incorrect. The latest Linksys firmware (4.30.14) and all previous versions are still vulnerable."

An anonymous reader writes "After the Department of Homeland Security's US-CERT warned users to disable Java to stop hackers from taking control of users' machines, Oracle issued an emergency patch on Sunday. However, HD Moore, chief security officer of Rapid7, said it could take two years for Oracle to fix all the security flaws in the version of Java used to surf the web; that timeframe doesn't count any additional Java exploits discovered in the future. 'The safest thing to do at this point is just assume that Java is always going to be vulnerable,' Moore said."