×
IT

US Justice Dept. Sues eBay For Anti-Competitive Hiring Practices 66

Posted by timothy from the scratcha-my-back dept.
McGruber writes "The Associated Press is reporting that the U.S. Justice Department is suing eBay for allegedly agreeing with Intuit not to hire each other's employees. According to the article, 'eBay's agreement with Intuit hurt employees by lowering the salaries and benefits they might have received and deprived them of better job opportunities at the other company,' said acting Assistant Attorney General Joseph Wayland, who is in charge of the Justice Department's antitrust division. The division 'has consistently taken the position that these kinds of agreements are per se (on their face) unlawful under antitrust laws.'"
Bug

iOS 6 Streaming Bug Sends Data Usage Skyrocketing 98

Posted by Soulskill from the please-don't-start-calling-this-streamgate dept.
MojoKid writes "iOS 6, by all appearances, has a streaming problem. This is separate from the network issues that led Verizon to state that it wouldn't bill people for overages that were caused by spotty Wi-Fi connectivity. The issue has been detailed at PRX.org with information on how the team saw a huge spike in bandwidth usage after the release of iOS 6, and then carefully tested the behavior of devices and its own app to narrow the possible cause. In one case, the playback of a single 30MB episode caused the transfer of over 100MB of data. It is believed that the issue was solved with the release of iOS 6.0.1, but anecdotal evidence from readers points to continued incidents of high data usage, even after updating. If you own an iPhone 5 or upgraded to iOS 6 on an older device, it is strongly recommend to check your usage over the past two months, update to iOS 6.0.1, and plan for a lengthy discussion with your carrier if it turns out your data use went through the roof."
Security

Will It Take a 'Cyber Pearl Harbor' To Break Congressional Deadlock? 104

Posted by Soulskill from the or-perhaps-a-cybertsunami,-or-a-cyberarmageddon dept.
Hugh Pickens writes "For years lawmakers had heard warnings about holes in corporate and government systems that imperil U.S. economic and national security. Now Ward Carroll writes that in the face of what most experts label as a potential 'Cyber Pearl Harbor' threat, Republicans have stalled the Cybersecurity Act of 2012 with a Senate vote of 51–47 against the legislation. This drew a quick response from the staff of Secretary of Defense Leon Panetta: 'The U.S. defense strategy calls for greater investments in cybersecurity measures, and we will continue to explore ways to defend the nation against cyber threats,' says DoD spokesman George Little. 'If the Congress neglects to address this security problem urgently, the consequences could be devastating.' Many Senate Republicans took their cues from the U.S. Chamber of Commerce and businesses that framed the debate not as a matter of national security, but rather as a battle between free enterprise and an overreaching government. They wanted to let companies determine whether it would be more cost effective — absent liability laws around cyber attacks — to invest in the hardware, software, and manpower required to effectively prevent cyber attacks, or to simply weather attacks and fix what breaks afterwards. 'Until someone can argue both the national security and the economic parts of it, you're going to have these dividing forces,' says Melissa Hathaway, a White House cyber official in the Bush and Obama administrations. 'Most likely, big industry is going to win because at the end of the day our economy is still in trouble.'"
Security

High Security Animal Disease Lab Faces Uncertain Future 105

Posted by samzenpus from the not-in-my-backyard dept.
Dupple writes in with a story about the uncertain future of a proposed bio lab in the heart of cattle country. "Plans to build one of the world's most secure laboratories in the heart of rural America have run into difficulties. The National Bio and Agro defense facility (NBAF) would be the first US lab able to research diseases like foot and mouth in large animals. But reviews have raised worries about virus escapes in the middle of cattle country. For over fifty years the United States has carried out research on dangerous animal diseases at Plum Island, just off the coast of New York. However after 9/11 the Department of Homeland Security raised concerns about the suitability of the location and its vulnerability to terrorist attack."
Government

House Subcommittee Holds Hearing On TSA's "Scanner Shuffle" 134

Posted by samzenpus from the who's-to-blame dept.
OverTheGeicoE writes "The Homeland Security Subcommittee on Transportation Security held a hearing on TSA's recent decision to move X-ray body scanners from major airports to smaller ones, which the subcommittee refers to as a 'Scanner Shuffle.' John Sanders, TSA's assistant administrator for security capabilities, testified that 91 scanners recently removed from major airports were now in storage due to 'privacy concerns.' Although TSA originally planned to relocate the scanners to smaller airports, those plans have been shelved because smaller airports don't have room for them. The subcommitteee is also investigating allegations that the machines' manufacturer, Rapiscan, 'may have falsified tests of software intended to stop the machines from recording graphic images of travelers' (VIDEO). Coincidentally, shares of Rapiscan's parent company, OSI Systems Inc., dropped in value almost 25% today, its biggest intraday decline in about 12 years. If wrongdoing is proven, Rapiscan could face fines, prison terms and a ban on government contracting, according to a former head of federal procurement."
NASA

NASA To Encrypt All of Its Laptops 226

Posted by timothy from the violators-will-be-employed-with-social-security dept.
pev writes "After losing another laptop containing personal information, NASA wants to have all of its laptops encrypted within a month's time with an intermediate ban on laptops containing sensitive information leaving its facilities. Between April 2009 and April 2011 it lost or had stolen 48 'mobile computing devices.' I wonder how long it will be before other large organizations start following suit as a sensible precaution?"
Cellphones

Papa John's Sued For Unwanted Pizza-Related Texts 418

Posted by samzenpus from the spam-spam-spam-pizza-spam dept.
jfruh writes "Nationwide pizza chain Papa John's is finding itself on the receiving end of a $250 million text spam lawsuit. From the article: 'Seattle law firm Heyrich Kalish McGuigan, representing three Papa John's customers, alleged that the pizza delivery service has sent 500,000 unwanted text messages to customers. If the court finds that Papa John's violated the U.S. Telephone Consumer Protection Act, the pizza maker could have to pay damages of $500 per text message, or US$250 million, one of the largest damage awards under the 1991 law, the law firm said. "Many customers complained to Papa John's that they wanted the text messages to stop, and yet thousands of spam text messages were sent week after week," Donald Heyrich, attorney for the plaintiffs said in a statement. "This should be a wake-up call to advertisers. Consumers do not want spam on their cell phones."'
Software

US Air Force Scraps ERP Project After $1 Billion Spent 362

Posted by samzenpus from the on-second-thought dept.
angry tapir writes "The U.S. Air Force has decided to scrap a major ERP (enterprise resource planning) software project after spending $1 billion, concluding that finishing it would cost far too much more money for too little gain. Dubbed the Expeditionary Combat Support System (ECSS), the project has racked up $1.03 billion in costs since 2005, 'and has not yielded any significant military capability,' an Air Force spokesman said in a statement. 'We estimate it would require an additional $1.1B for about a quarter of the original scope to continue and fielding would not be until 2020. The Air Force has concluded the ECSS program is no longer a viable option for meeting the FY17 Financial Improvement and Audit Readiness (FIAR) statutory requirement. Therefore, we are canceling the program and moving forward with other options in order to meet both requirements.'"
Security

Hacker Grabs 150k Adobe User Accounts Via SQL Injection 64

Posted by samzenpus from the breaking-in dept.
CowboyRobot writes "Adobe today confirmed that one of its databases has been breached by a hacker and that it had temporarily taken offline the affected Connectusers.com website. The hacker, who also goes by Adam Hima, told Dark Reading that the server he attacked was the Connectusers.com Web server, and that he exploited a SQL injection flaw to execute the attack. 'It was an SQL Injection vulnerability, somehow I was able to dump the database in less requests than normal people do,' he says. Users passwords for the Adobe Connectusers site were stored and hashed with MD5, he says, which made them 'easy to crack' with freely available tools. And Adobe wasn't using WAFs on the servers, he notes. Tal Beery, a security researcher at Imperva, analyzed the data dump in the Connectusers Pastebin post and found that the list appears to be valid and that the hacked database was relatively old."
Network

Battery-Powered Transmitter Could Crash A City's 4G Network 121

Posted by Soulskill from the new-york-must-have-a-lot-of-these dept.
DavidGilbert99 writes "With a £400 transmitter, a laptop and a little knowledge you could bring down an entire city's high-speed 4G network. This information comes from research carried out in the U.S. into the possibility of using LTE networks as the basis for a next-generation emergency response communications system. Jeff Reed, director of the wireless research group at Virginia Tech, along with research assistant Marc Lichtman, described the vulnerabilities to the National Telecommunications and Information Administration, which advises the White House on telecom and information policy. 'If LTE technology is to be used for the air interface of the public safety network, then we should consider the types of jamming attacks that could occur five or ten years from now (PDF). It is very possible for radio jamming to accompany a terrorist attack, for the purpose of preventing communications and increasing destruction,' Reed said."
Communications

Skype Disables Password Resets After Huge Security Hole Discovered 65

Posted by Unknown Lamer from the time-to-get-a-landline dept.
another random user writes with news of a vulnerability in the Skype password reset tool "All you need to do is register a new account using that email address, and even though that address is already used (and the registration process does tell you this) you can still complete the new account process and then sign in using that account Info (original post in Russian)" concealment adds a link to another article with an update that Skype disabled the password reset page as a temporary fix.
Security

Cyberespionage For Everyone 44

Posted by Soulskill from the senior-discount-kids-get-in-free dept.
Mephistophocles writes "A chilling article by Darkreading's Kelly Jackson Higgins describes how the growing accessibility of hacking tools like RATs (Remote Access Trojans) have made cyber-espionage possible for more than just those financially backed by large nation-states, and speculates on what the implications of this may be: 'Researchers at Norman Security today revealed that they recently analyzed malware used in phishing emails targeting Israeli and Palestinian targets and found that attackers used malware based on the widely available Xtreme RAT crimeware kit. The attacks, which first hit Palestinian targets, this year began going after Israeli targets, including Israeli law enforcement agencies and embassies around the world. Norman says the same attacker is behind the attacks because the attacks use the same command-and-control (C&C) infrastructure, as well as the same phony digital certificates. This attack campaign just scratches the surface of the breadth and spread of these types of attacks around the world as more players have been turning to cyberspying. "We're just seeing the tip of the iceberg," says Einar Oftedal, deputy CTO at Norman.'"
Crime

John McAfee Accused of Murder, Wanted By Belize Police 353

Posted by samzenpus from the bad-stuff dept.
New submitter thn writes "John McAfee, who started the antivirus software giant named after him, has been accused of murder in Belize and is wanted. McAfee had taken to 'posting on a drug-focused Russian message board...about his attempts to purify the psychoactive compounds colloquially known as "bath salts,"' Gizmodo wrote. The scariest aspect of this story may be the fact that an entire lab was constructed for John McAfee's research purposes. Because of his efforts to extract chemicals from natural chemical plans McAfee was able to justify his experiments in a country that is largely unregulated."
Security

How Red Teams Hack Your Site To Save It 58

Posted by samzenpus from the we-had-to-destroy-the-village-in-order-to-save-it dept.
Nerval's Lobster writes "The use of a Red Team and penetration testing can strengthen an organization's security posture. But how does a Red Team member actually think like an attacker, and use that mindset to exploit security vulnerabilities? Gillis Jones works for WhiteHat Security, where his job rests within the TRC (Threat Research Center). It's here that he performs hands-on site assessments, which involve manually confirming all the issues reported by an automatic scan of a particular Website or application. His job includes checking the application's POST and GET requests for reflection of any inputs. He also checks for Cross-Site Scripting (XSS), which includes stored, reflected, and DOM XSS vulnerabilities. Those checks let him determine the Website’s basic security posture. If user input isn’t encoded or sanitized, that’s a good indicator of other problems. And if that’s the case, then Jones (or someone like him) will move on to checking for SQL Injection (SQLi) vulnerabilities and other issues."
Encryption

Meet the Lawyer Suing Anyone Who Uses SSL 347

Posted by samzenpus from the mine-all-mine dept.
Sparrowvsrevolution writes "Since 2008, Dallas, Texas attorney Erich Spangenberg and his company TQP have been launching suits against hundreds of firms, claiming that merely by using SSL, they've violated a patent TQP acquired in 2006. Nevermind that the patent was actually filed in 1989, long before the World Wide Web was even invented. So far Spangenberg's targets have included Apple, Google, Intel, Dell, Hewlett-Packard, every major bank and credit card company, and scores of web startups and online retailers, practically anyone who encrypts pages of a web sites to protect users' privacy. And while most of those lawsuits are ongoing, many companies have already settled with TQP rather than take the case to trial, including Apple, Amazon, Dell, and Exxon Mobil. The patent has expired now, but Spangenberg can continue to sue users of SSL for six more years and seems determined to do so as much as possible. 'When the government grants you the right to a patent, they grant you the right to exclude others from using it,' says Spangenberg. 'I don't understand why just because [SSL is] prevalent, it should be free.'"
Facebook

Homeland Security Mining Social Media For Signs of Bio Attacks 96

Posted by samzenpus from the friend-your-anthrax dept.
jjp9999 writes "Nextgov reports, 'The Homeland Security Department has commissioned Accenture to test technology that mines open social networks for indications of pandemics, according to the vendor.' This will kick off a year-long biosurveillance program, costing $3 million, that will log trends in public health by looking through public posts. This ties back to White House guidelines released in July that ask federal agencies to 'Consider social media as a force multiplier that can empower individuals and communities to provide early warning and global situational awareness.'"
Government

Support Forums Reveal SCADA Infections 66

Posted by samzenpus from the patient-zero dept.
chicksdaddy writes "We hear a lot about vulnerabilities in industrial control system (ICS) software. But what about real evidence of compromised SCADA and industrial control systems? According to security researcher Michael Toecker, a consultant at the firm Digital Bond, the evidence for infected systems with links to industrial automation and control systems is right under our eyes: buried in public support forums. Toecker audited support sites like bleepingcomputer.com, picking through data dumps from free malware scanning tools like HijackThis and DDS. He found scans of infected systems that were running specialized ICS software like Schweitzer Engineering Labs (SEL) AcSELerator Software and GE Power's EnerVista Software (used to configure GE electric power protection products). The infected end user systems could be the pathway to compromising critical infrastructure, including electrical infrastructure. 'With access to a protection relay through a laptop, a malicious program could alter settings in the configuration file, inject bad data designed to halt the relay, or even send commands directly to the relay when a connection was made,' Toecker wrote."
Displays

Color-Screen TI-84 Plus Calculator Leaked 245

Posted by samzenpus from the adding-old-school dept.
KermMartian writes "It has been nearly two decades since Texas Instruments released the TI-82 graphing calculator, and as the TI-83, TI-83+, and TI-84+ were created in the intervening years, these 6MHz machines have only become more absurdly retro, complete with 96x64-pixel monochome LCDs and a $120 price tag. However, a student member of a popular graphing calculator hacking site has leaked pictures and details about a new color-screen TI-84+ calculator, verified to be coming soon from Texas Instruments. With the lukewarm reception to TI's Nspire line, it seems to be an attempt to compete with Casio's popular color-screen Prizm calculator. Imagine the graphs (and games!) on this new 320x240 canvas."
Security

Nike+ FuelBand: Possibly a Big Security Hole For Your Life 162

Posted by Soulskill from the youtube-generation-wouldn't-even-flinch dept.
MojoKid writes "Nike+ FuelBand is a $149 wristband with LED display that tracks your daily activity, tells you how many calories you've burned, lets you know how much fuel you have left in the tank, and basically keeps track of 'every move you make.' If you think that sounds like a privacy nightmare waiting to happen, it pretty much is. A source directly connected to Nike reported an amusing, albeit startling anecdote about a guy who got caught cheating on his girlfriend because of the Nike+ FuelBand. 'They shared their activity between each other and she noticed he was active at 1-2AM, when he was supposed to be home.' That's just one scenario. What if the wristband gets lost or stolen? How much data is actually stored on these sorts of devices? And remember, you're syncing it to the cloud with an iOS or Android app."

Slashdot Top Deals