mask.of.sanity writes "Lights, sounds and magnetic fields can be used to activate malware on phones, new research has found. The lab-style attacks defined in a paper (PDF) used pre-defined signals hidden in songs and TV programmes as a trigger to activate embedded malware. Malware once activated would carry out programmed attacks either by itself or as part of a wider botnet of mobile devices."

puddingebola writes with this excerpt from a Bloomberg report: "The Pentagon cleared Apple Inc. (AAPL) devices for use on its networks, setting the stage for the maker of iPhones and iPads to compete with Samsung Electronics Co. and BlackBerry for military sales. The Defense Department said in a statement [Friday] that it has approved the use of Cupertino, California-based Apple's products running a version of the iOS 6 mobile platform. The decision eventually may spur a three-way fight for a market long dominated by Waterloo, Ontario-based BlackBerry.'" Also, Apple devices are best for uploading viruses to alien craft.

First time accepted submitter russotto points out the claim of industry group TechAmerican Foundation (reported by Computerworld) that "wages for the software industry are falling, not rising. Wages fell 2% to $99,000 in 2012." Averages are one thing; the article points out though that wages vary vastly within the industry, and that some jobs are harder to fill (thus, better paid) than others. An excerpt: "Victor Janulaitis, CEO of Janco Associates, a research firm that also analyzes IT wage and employment trends, cited a number of reason for the decline in wages for software professionals. First, technology is becoming easier to implement without having an IT professional, he said. Also, the option of turning to outsourcing creates less pressure to increase wages. As the recession continues, companies continue 'to look at productivity and will often look to hire individuals who are lower cost employees,' said Janulaitis. That could include displaced baby boomer workers who have been out of work for some time and 'will take a lower paying job just to get back into the workforce.'"

Madwand writes "The NetBSD Project is pleased to announce NetBSD 6.1, the first feature update of the NetBSD 6 release branch. It represents a selected subset of fixes deemed important for security or stability reasons, as well as new features and enhancements. NetBSD is a free, fast, secure, and highly portable Unix-like Open Source operating system. It is available for a wide range of platforms, from large-scale servers and powerful desktop systems to handheld and embedded devices. Its clean design and advanced features make it excellent for use in both production and research environments, and the source code is freely available under a business-friendly license. NetBSD is developed and supported by a large and vibrant international community. Many applications are readily available through pkgsrc, the NetBSD Packages Collection."

An anonymous reader writes "Having entered my personal details (full real name, home address) to websites with an 'https://' prefix in order to purchase goods, I am still being sent emails from companies (or their agents) which include, in plain text, those same details I have entered over a secure connection. These are often companies which are very keen to tell you how much they value your privacy and how they will not pass your details on to third parties. What recourse does one have to tell them to desist from such behaviour whilst still doing business with them if their products are otherwise desirable? I email the relevant IT team as a matter of course to tell them it's not appropriate (mostly to no avail), but is there any legislation — in any territory — which addresses this?"

msm1267 writes "Many popular online services have started to deploy password strength meters, visual gauges that are often color-coded and indicate whether the password you've chosen is weak or strong based on the website's policy. The effectiveness of these meters in influencing users to choose stronger passwords had not been measured until recently. A paper released this week by researchers at the University of California Berkeley, University of British Columbia, and Microsoft provides details on the results of a couple of experiments examining how these meters influence computer users when they're creating passwords for sensitive accounts and for unimportant accounts."

An anonymous reader writes "Tom's Hardware reports on the Connectify Switchboard software that "divides the user's traffic between Wi-Fi, 3G/4G and Ethernet-based connections on a packet-by-packet basis. Even a single stream — such as a Netflix movie — can be split between two or three Internet connections for a higher resolution and faster buffering." As part of its Kickstarter campaign, Connectify is geolocating their backers to optimize deployment of their servers. This is a clever way for supporters to influence the project beyond pledge levels and stretch goals, and it's actually kind of fun to watch."

hypnosec writes "Mozilla is not going ahead with its plans to block third-party cookies by default in the Beta version of its upcoming Firefox 22. Mozilla needs more time to analyze the outcome of blocking these cookies. The non-profit organization released Firefox Aurora on April 5 with a patch by Jonathan Mayer built into it which would only allow cookies from those websites which the user has visited. The patch would block the ones from sites which hadn't been visited yet. The reason for Mozilla's change in plans is that they're currently looking into 'false positives.' If a user visits one part of a group of site, cookies from that part will be allowed, but cookies from related sites in the group may be blocked, and they're worried it will create a poor user experience. On the other side of the coin, there are 'false negatives.' Just because a user may have visited a particular site doesn't mean she is comfortable with the idea of being tracked."

alphadogg writes "A data center in Sweden has cut its energy bills by a million dollars a year using seawater to cool its servers, though jellyfish are an occasional hazard. Interxion, a collocation company in the Netherlands that rents data center space in 11 countries, uses water pumped from the Baltic Sea to cool the IT equipment at its facilities in Stockholm. The energy used to cool IT equipment is one of the costliest areas of running a data center. Companies have traditionally used big, mechanical chillers, but some are turning to outside air and evaporative techniques as lower-cost alternatives."

msm1267 writes "Conpot, short for Control Honeypot, is one of the first publicly available honeypots for industrial control systems (ICS) and SCADA gear. Built by two researchers from the Honeynet Project, the hope is that others will take what they started, deploy it on their own critical infrastructure networks and share the findings. 'The main goal is to make this kind of technology available for a general audience,' said Lukas Rist, one of the developers. 'Not just for security researchers, but also for people who are sysadmins setting up ICS systems who have no clue what could happen and want to see malware attacks against their systems and not put them in any danger.'" Unlike previous ICS Honeypots, this one simulates the control systems rather than requiring that you happen to own an actual industrial control system.

CowboyRobot writes "At the recent 2013 Open Networking Summit, Google Distinguished Engineer Amin Vahdat presented 'SDN@Google: Why and How', in which he described Google's 'B4' SDN network, one of the few actual implementations of software-defined networking. Google has deployed sets of Network Controller Servers (NCSs) alongside the switches, which run an OpenFlow agent with a 'thin level of control with all of the real smarts running on a set of controllers on an external server but still co-located.' By using SDN, Google hopes to increase efficiency and reduce cost. Unlike computation and storage, which benefit from an economy of scale, Google's network is getting much more expensive each year."

Today The New Yorker unveiled a project called Strongbox, which aims to let sources share tips and leaks with the news organization in a secure manner. It makes use of the TOR network and encrypts file uploads with PGP. Once the files are uploaded, they're transferred via thumb-drive to a laptop that isn't connected to the internet, which is erased every time it is powered on and booted with a live CD. The publication won't record any details about your visit, so even a government request to look at their records will fail to find any useful information. "There’s a growing technology gap: phone records, e-mail, computer forensics, and outright hacking are valuable weapons for anyone looking to identify a journalist’s source. With some exceptions, the press has done little to keep pace: our information-security efforts tend to gravitate toward the parts of our infrastructure that accept credit cards." Strongbox is actually just The New Yorker's version of a secure information-sharing platform called DeadDrop, built by Aaron Swartz shortly before his death. DeadDrop is free software.

msm1267 writes "There are a lot of echoes of the disclosure debate in the current discussions about vulnerability exploit sales. The commercial exploit market has developed relatively quickly, at least the public portion of it. Researchers have been selling vulnerabilities to a variety of buyers – government agencies, contractors, other researchers and third-party brokers – for years. But it was done mostly under cover of darkness. Now, although the transactions themselves are still private, the fact that they're happening, and who's buying (and in some cases, selling) is out in the open. As with the disclosure debate, there are intelligent people lining up on both sides of the aisle and the discussion is generating an unprecedented level of malice."

An anonymous reader writes "Mozilla on Tuesday officially launched Firefox 21 for Windows, Mac, Linux, and Android. Improvements include the addition of multiple social providers on the desktop as well as open source fonts on Android. In the changelog, the company included an interesting point that's worth elaborating on: 'Preliminary implementation of Firefox Health Report.' Mozilla has revealed that FHR so far logs 'basic health information' about Firefox: time to start up, total running time, and number of crashes. Mozilla says the initial report is pretty simple but will grow 'in the coming months.' You can get it now from Mozilla."

Nerval's Lobster writes "Roughly 85 percent of IT managers polled by Forrester said they would hold onto networking infrastructure longer, but vendors retire products prematurely in an effort to force customers to upgrade. In a response that may seem familiar to anyone who's ever been pressured into buying a maintenance contract—either by an enterprise vendor or a major electronics retailer—over 80 percent of the 304 respondents said they don't like the misrepresented cost savings, new fees, and inflexible pricing models—but buy the products anyway. One of the survey's interesting points is that IT decision makers aren't willing to contradict the vendor. The uncertainty seems to come from the fact that the vendor may in fact be right—and a customer who contradicts what they're saying may end up shouldering the blame if the equipment goes south. It's the 'you never got fired for buying IBM' argument, applied to the networking space. The problem, of course, is that the vendor often works for its own agenda. Do you upgrade when the vendor (or reseller) suggests you do so? Or do you stick to your own way of doing things?"