vikingpower writes "As a previous Slashdot story already reported, Ruby on Rails was recently reported to suffer from a major SQL injection flaw. This has prompted the Dutch government to take the one and only national site for citizens' digital identification offline (link in Dutch, Google translation to English). Here is the English-language placeholder page for the now-offline site. This means that 16 million Dutch citizens cannot authenticate themselves anymore with government instances, and that those same government instances can not communicate anything to those same citizens anymore." Fixes were released, so it looks like it's on their sysadmin team now.
Catch up on stories from the past week (and beyond) at the Slashdot story archive
judgecorp writes "British Members of Parliament have warned that the UK's cyber warfare strategy is getting it wrong. According to a defense committee report, the country's IT security forces are inadequately prepared for a cyber attack, rely too heavily on inadequately protected systems, and do not sufficiently appreciate the difficulty of attributing the source of an attack."
mask.of.sanity writes "Researchers have examined writing styles to identify previously anonymous carders and hackers operating on underground forums. Up to 80 percent of users who wrote at least 5000 words across their posts could be identified using linguistic techniques. Techniques such as stylometric analysis were used to track users who posted across different forums, and could even be used to unveil authors of thesis papers or blogs who had taken to underground networks."
New submitter uCallHimDrJ0NES writes "Security researcher Mark Gamache has used Moxie Marlinspike's Cloudcracker to derive hashes from captured NTLM handshakes, resulting in successful pass-the-hash attacks. It's been going on for a long time, probably, but this is the first time a 'white hat' has researched and exposed the how-to details for us all to enjoy. 'You might think that with all the papers and presentations, no one would be using NTLM...or, God forbid, LM. NTLMv2 has been around for quite some time. Surely, everyone is using it. Right? Wrong! According to the last data from the W3 Schools, 21% of computers are running XP, while NetMarketShare claims it is 39%. Unless someone has hardened these machines (no MS patches do this), these machines are sending LM and NTLM responses!' Microsoft has posted a little guidance for those who need to turn off NTLM. Have fun explaining your new security project to your management, server admins!"
Spy Handler writes "A software update of the California welfare computer system (CalWIN) caused 37,000 Food Stamp recipients to lose their EBT (a credit card paid for by the government) benefits last weekend. According to the article, Hewlett Packard was responsible for the failed update of CalWIN, but at 8:00 a.m. today Xerox (who administers another state welfare system called CalFresh) issued a patch that reactivated the EBT cards."
chicksdaddy writes "A security researcher who was looking for vulnerabilities in Facebook's platform instead stumbled on a much larger hole that could affect scores of firms who rely on a secure file transfer platform from Accellion. Writing on his blog on Monday, Israeli researcher Nir Goldshlager said he discovered the password reset vulnerability while analyzing a Accellion deployment that is used, internally, by Facebook employees. Goldshlager used public knowledge of the Accellion platform to access a hidden account creation page for the Facebook deployment and create a new Facebook/Accellion account linked to his e-mail address. After analyzing Accellion's password reset feature, he realized that — with that valid account — he could reset the password of any other Facebook/Accellion user with some cutting and pasting and a simple HTTP POST request, provided he knew the user's login e-mail address — effectively hijacking the account. Goldshlager said he informed Facebook and that the hole has been patched by Facebook and Accellion. However, other Accellion customers using private cloud deployments of the product could still be vulnerable."
New submitter Fnordulicious writes "Although Canada's anti-spam legislation is already in place, the rules to implement it have been under development for more than a year. This weekend the proposed rules from the Department of Industry were published in the Canada Gazette. Kady O'Malley reports on the CBC Inside Politics Blog that Canadian ISPs will not be allowed to secretly monitor activity except in the case that the activity is illegal and represents an 'imminent risk to the security of its network.' In addition, consent would be required for monitoring of legal activities 'that are merely unauthorized or suspicious.'"
CowboyRobot writes with news about a federal initiative to support federated authentication for government services. From the article: "The U.S. Postal Service will be the guinea pig for a White House-led effort to accelerate government adoption of technologies that allow federal agencies to accept third-party identity credentials for online services. The program involves using services ... through standards like OpenID rather than requiring users to create government usernames and passwords. ... The federated identity effort, known as the Federal Cloud Credential Exchange, is just one piece of a broader Obama administration online identity initiative: the National Strategy for Trusted Identities in Cyberspace (NSTIC), which aims to catalyze private sector-led development of a secure, digital 'identity ecosystem' to better protect identities online. ... The Postal Service pilot is but one of several different pilots that are part of NSTIC. There are also three cryptography pilots and two non-cryptographic privacy pilots in the works. Each of those pilots is being carried out by multiple private sector organizations ranging from the Virginia Department of Motor Vehicles to AOL to AARP to Aetna."
Qedward writes "Software developed by the FBI and Ernst & Young has revealed the most common words used in email conversations among employees engaged in corporate fraud. The software, which was developed using the knowledge gained from real life corporate fraud investigations, pinpoints and tracks common fraud phrases like 'cover up,' write off,' 'failed investment,' 'off the books,' 'nobody will find out' and 'grey area'. Expressions such as 'special fees' and 'friendly payments' are most common in bribery cases, while fears of getting caught are shown in phrases such as 'no inspection' and 'do not volunteer information.'"
This video is an interview with Matt Heusser, who makes a good living as an independent IT consultant. He says many other people who are currently pounding out code or performing other routine computer-oriented tasks can become independent, too. He's not selling a course or anything here, just passing on some advice to fellow Slashdot readers. He's written up some of this advice in a series of four articles: Getting People to Throw Money At You; How to become IT Talent; That Last Step to Become ‘Talent’ In IT; and The Schwan’s Solution. He also gave a speech last November titled Building your reputation through creative disobedience. (The link is to a 50 minute video of that speech.) Anyway, we figure quite a few Slashdot readers are at least as smart as Matt and may want to take some career steps similar to the ones he has taken. In today's video, he gives you some ideas about how to stop being an IT worker and how to become IT talent instead.
Orome1 writes "A group of researchers from the Institute of Telecommunications of the Warsaw University of Technology have devised a way to send and receive messages hidden in the data packets used to represent silences during a Skype call. After learning that Skype transmits voice data in 130-byte packets and the silences in 70-byte packets, the researchers came upon the idea of using the latter to conceal the sending and receiving of additional messages."
First time accepted submitter msamp writes "After the dotcom bubble burst so long ago,when tech jobs were so scarce, I went back to school and finished my PhD in Physics. They lied — there really is no shortage of scientists. Before the downturn I was a product manager for home networking equipment. Since getting the degree I have been program/project manager for small DoD and NASA instrumentation programs. I desperately want back into network equipment product management, but my networking tech skills aren't up to date. I find networking technology absolutely trivial and have been retraining on my own, but hiring managers see the gap and the PhD and run screaming. I'm more than willing to start over in network admin but can't even get considered for that. Suggestions?"
wiredmikey writes "NVIDIA on Saturday quietly released a driver update (version 310.90) that fixes a recently-uncovered security vulnerability in the NVIDIA Display Driver service (nvvsvc.exe). The vulnerability was disclosed on Christmas day by Peter Winter-Smith, a researcher from the U.K. According to Rapid7's HD Moore, the vulnerability allows a remote attacker with a valid domain account to gain super-user access to any desktop or laptop running the vulnerable service, and allows an attacker (or rogue user) with a low-privileged account to gain super-access to their own system. In addition to the security fix, driver version 310.90 addresses other bugs and brings performance increases for several games and applications for a number of GPUs including the GeForce 400/500/600 Series."
McGruber writes "Travel writer Christopher Elliott touches down with the news that the U.S. Transportation Security Administration was spotted standing around outside a recent American football game between the Minnesota Vikings and the Green Bay Packers (picture). According to Mr. Elliott, the 'TSA goes to NFL games and political conventions and all kinds of places that have little or nothing to do with ... travel. It even has a special division called VIPR — an unfortunate acronym for Visible Intermodal Prevention and Response team — that conducts these searches.' He continues, 'As far as I can tell, TSA is just asking questions at this point. "Data and results collected through the Highway BASE program will inform TSA's policy and program initiatives and allow TSA to provide focused resources and tools to enhance the overall security posture within the surface transportation community," it says in the filing. But they wouldn't be wasting our money asking such questions unless they planned to aggressively expand VIPR at some point in the near future. And that means TSA agents at NFL games, in subways and at the port won't be the exception anymore — they will be the rule.'"
paysonwelch points out John McAfee's latest blog post, which "details the complex spy network that he used to tap information from the highest echelons of the Belizean government. He might consider a new career as a movie producer — this blog post is enthralling. Here is an excerpt: 'I purchased 75 cheap laptop computers and, with trusted help, intalled invisible keystroke logging software on all of them — the kind that calls home (to me) and disgorges the text files. I began giving these away as presents to select people — government employees, police officers, Cabinet Minister's assistants, girlfriends of powerful men, boyfriends of powerful women.'"