Forgot your password?
typodupeerror

Follow Slashdot stories on Twitter

Security

Cryptome Hit By Blackhole Exploit Kit 49

Posted by Unknown Lamer
from the leaks-were-sleeping-around dept.
wiredmikey writes with an excerpt from Security Week:"Whistleblower site Cryptome has been hacked and infected by the Blackhole exploit kit. ... Cryptome co-founder John Young however told SecurityWeek that the Cryptome site is in the process of cleaning everything up, and that process should be finished by the end of the day. Founded in 1996, Cryptome publishes thousands of documents, including many related to national security, law enforcement and military. On Feb. 12, a reader advised the site that accessing a file had triggered a warning in their antivirus about the Blackhole exploit kit. ... Subsequent analysis found thousands of files on the site had been infected." Cryptome has certainly seen worse.
Google

How To Pull Location Data From Encrypted Google Maps Sessions 28

Posted by Soulskill
from the step-one-create-1:1-model-of-the-earth dept.
Trailrunner7 writes "In the last couple of years, Google and some other Web giants have moved to make many of their services accessible over SSL, and in many cases, made HTTPS connections the default. That's designed to make eavesdropping on those connections more difficult, but as researchers have shown, it certainly doesn't make traffic analysis of those connections impossible. Vincent Berg of IOActive has written a tool that can monitor SSL connections and make some highly educated guesses about the contents of the requests going to Google Maps, specifically looking at what size the PNG files returned by Google Maps are. The tool then attempts to group those images in a specific location, based on the grid and tile system that Google uses to construct its maps."
China

Best Practice: Travel Light To China 334

Posted by timothy
from the micro-sd-in-dental-work dept.
Hugh Pickens writes "What may once have sounded like the behavior of a raving paranoid is now considered standard operating procedure for officials at American government agencies, research groups and companies as the NY Times reports how businesses sending representatives to China give them a loaner laptop and cellphone that they wipe clean before they leave and wipe again when they return. 'If a company has significant intellectual property that the Chinese and Russians are interested in, and you go over there with mobile devices, your devices will get penetrated,' says Joel F. Brenner, formerly the top counterintelligence official in the office of the director of national intelligence. The scope of the problem is illustrated by an incident at the United States Chamber of Commerce in 2010 when the chamber learned that servers in China were stealing information from four of its Asia policy experts who frequently visited China. After their trips, even the office printer and a thermostat in one of the chamber's corporate offices were communicating with an internet address in China. The chamber did not disclose how hackers had infiltrated its systems, but its first step after the attack was to bar employees from taking devices with them 'to certain countries,' notably China. 'Everybody knows that if you are doing business in China, in the 21st century, you don't bring anything with you,' says Jacob Olcott, a cybersecurity expert at Good Harbor Consulting. 'That's "Business 101" — at least it should be.'"
Businesses

Why Microsoft Developers Need a Style Guide 262

Posted by timothy
from the offense-is-the-worst-thing-in-the-world dept.
snydeq writes "What your interface communicates to users can be just as important as what your software does, writes Fatal Exception's Neil McAllister in discussing the latest edition of the 'Microsoft Manual of Style', a style guide aimed at designers and developers who create Microsoft software, as well as those who write about it. 'The gist of much of Microsoft's advice is that a user's relationship with computer software is a unique one, and it's important to craft the language of software UIs accordingly,' McAllister writes. 'Occasionally, Microsoft's recommendations verge on the absurd. For example, you might not think it necessary to admonish developers to "not use slang that may be considered profane or derogatory, such as 'pimp' or 'bitch,'" but apparently it is.'"
Security

Southwest Airlines iPhone App Unencrypted, Vulnerable To Eavesdroppers 139

Posted by timothy
from the one-more-path-to-id-theft dept.
New submitter davidstites writes "I am a masters computer science student at University of Colorado at Colorado Springs, and in November I performed a security audit of 230+ popular iOS applications because I wanted to know how secure apps on smartphones and tablets really are. I made a shocking discovery. The largest single potential security breach was with the Southwest Airlines application. Southwest Airlines' iPhone app leaves a user's information vulnerable to hackers. When you login to the application on your phone using your Rapid Rewards account, the app submits your username and password information as plain-text (unencrypted) to a Southwest remote server (mobile.southwest.com). A potential attacker can simply sniff for the data on the network and steal it. This situation is a hackers dream! If a victims credentials were captured, a hacker could use those credentials to login to that particular account and they would have access to anything the victim would have access to, such as addresses, birthdays, e-mail, phone and credit cards. They could even book a flight in the victims name." (Read on below for more details.)
Botnet

Tools, Techniques, Procedures of the RSA Hackers Revealed 54

Posted by timothy
from the more-links-than-a-sausage-factory dept.
An anonymous reader writes "Details of the tools, techniques and procedures used by the hackers behind the RSA security breach have been revealed in a research paper (PDF) published by Australian IT security company Command Five. The paper also, for the first time, explains links between the RSA hack and other major targeted attacks. This paper is a vendor-neutral must-read for any network defenders concerned by the hype surrounding 'Advanced Persistent Threats.'"
Electronic Frontier Foundation

Looking For Love; Finding Privacy Violations 112

Posted by timothy
from the my-profile's-all-lies-anyhow dept.
itwbennett writes "When you sign up for online dating, there's a certain amount of information you expect to give up, like whether or not your weight is proportional to your height. But you probably don't expect that your profile will remain online long after you stop subscribing to the service. In some cases your photo can be found even after being deleted from the index, according to the electronic frontier foundation (EFF), which identified six major security weaknesses in online dating sites."
Graphics

TMS9918A Retro Video Chip Reimplemented In FPGA, With VGA Out 126

Posted by timothy
from the disintergrated dept.
acadiel writes "Matthew H from the AtariAge.com TI-99/4A forum has finalized a design of a TMS 9918A replacement (with VGA out) for classic computer systems such as the ColecoVision, TI-99/4A, SpectraVision, MSX1, SpectraVision 128, and Tomy Tutor Home computers. This hardware project replaces the native video controller on these classic systems and enables them to have VGA output for the first time." (It's just under $100 to order one.)
Operating Systems

Bad Guys Use Open Source, Too 84

Posted by timothy
from the malice-aforethought dept.
First time accepted submitter colinneagle writes "Open source has been so successful in giving us software like Linux, Apache, Hadoop, etc., why wouldn't the open source method work with other types of software? Probably no one expected that the criminals behind vast malware trojans would adopt open source methods to make their malware more dangerous, but they have. According to this report from Seculert Research, the makers of Citadel, a variant of the Zeus Trojan are using open source models to hone their code and make the Trojan more dangerous."
Wireless Networking

FCC Maps the 3G Wasteland Of the Western US 173

Posted by timothy
from the desires-infinite-resources-scarce dept.
alphadogg writes "The Federal Communications Commission has released a map showing which counties across the U.S. lacked coverage from either 3G or 4G networks and found that wide swaths of the western half of the country were 3G wastelands, particularly in mountainous states such as Idaho and Nevada. This isn't particularly surprising since it's much more difficult for carriers to afford building out mobile data networks in sparsely populated mountainous regions, but it does underscore how large stretches of the United States lack access to mobile data services that people in the Northeast, South and Midwest now take for granted."
Censorship

Tor Tests Undetectably Encrypted Connections In Iran 157

Posted by timothy
from the great-song-from-flock-of-seagulls dept.
Sparrowvsrevolution writes "Ahead of the anniversary of Iran's revolution, the country's government has locked down its already-censored Internet, blocking access to many services and in some cases cutting off all encrypted traffic on the Web of the kind used by secure email, social networking and banking sites. In response, the information-freedom-focused Tor Project is testing a new tool it's calling 'obfsproxy,' or obfuscated proxy, which aims to make SSL or TLS traffic appear to be unencrypted traffic like HTTP or instant messaging data. While the tool currently only disguises SSL as the SOCKS protocol, in future versions it will aim to disguise encrypted traffic as any protocol the user chooses. Tor executive director Andrew Lewman says the idea is to 'make your Ferrari look like a Toyota by putting an actual Toyota shell over the Ferrari.'" Reader bonch adds: "A thread on Hacker News provides first-hand accounts as well as workarounds."
Google

After Rewrites, Google Wallet Still Has Holes 82

Posted by samzenpus
from the leaking-like-a-sieve dept.
itwbennett writes "A report from viaForensics makes clear that, despite efforts by Google to tighten up security after a poor evaluation in December, Google Wallet still stores data in too many places and could make it available too easily to be a secure way to make purchases using smartphones."
Google

Google Offering Cash For Your Cache 152

Posted by samzenpus
from the have-a-couple-bucks dept.
pigrabbitbear writes "The gradual transformation of the web into an ultra-personalized, corporate-owned social space in the cloud has raised more than a few legitimate concerns about data privacy. Google, for obvious reasons, has always been one of the top cheerleaders for this metamorphosis. Touting a fresh new privacy policy that allows data about you from all of their services to coalesce, they've recently been particularly bullish about rendering that increasingly realistic digital portrait of you that lies stuffed away in their servers. It has led us again to question: How much are we comfortable with our machines knowing about us? How much is our privacy really worth? With their new program, Google is now asking those questions quite directly, and preceding them with dollar signs. Are we all on the verge of making our own information age Faustian bargains?"
Government

Hacked Syrian Officials Used '12345' As Email Password 231

Posted by samzenpus
from the I've-got-the-same-combination-on-my-luggage dept.
Nominei writes "The Israeli newspaper Haaretz reports that the Syrian President, aides and staffers had their email hacked by Anonymous, who leaked hundreds of emails online. Reportedly, many of the accounts used the password '12345' (which their IT department probably warned them to change when the accounts got set up, of course)."
Businesses

The Gradual Death of the Brick and Mortar Tech Store 491

Posted by samzenpus
from the say-hello-to-the-dodo dept.
Cutting_Crew writes "As we all know brick and mortar stores have been closing left and right recently. We had CompUSA, Borders and Circuit City all close their doors within the last 4 years. According to an article on Forbes.com, it is spelled out pretty clearly why Best Buy is next in line to shut its doors for good. Some of the reasons highlighted include a 40% drop is Best Buy stock in 2011, lack of vision regarding their online services, management too concerned with store sales instead of margins and blatant disregard for quality customer service."

Entropy isn't what it used to be.

Working...