Slashdot Mirror
Domain: thestack.com
Stories and comments across the archive that link to thestack.com.
Stories · 460
-
Netflix Algorithm Tells You When Your Best Employee Is About To Leave You
An anonymous reader writes "Former Netflix data scientist Mohammad Sabah has used the basis of the video-streaming company's movie-recommendation engine to create a new system to predict when valuable employees are likely to leave your company for pastures new. The new application 'Workday Talent Insights' uses the basis of the engine to correlate diverse factors such as interval between promotions and current length of tenure with equivalent job opportunities at employment websites, in order to gauge 'corporate restlessness', and provide options for employers who identify potential leavers." -
Greenwald Criticizes Universities' Funding-Driven Collaboration With NSA
An anonymous reader writes Speaking at "Secrecy Week" at the University of Utah, one of the two journalists who helped disseminate Edward Snowden's revelations about the scope of National Security Agency surveillance has criticized universities which open up their campuses to government agencies in exchange for funding. Ex-Guardian journalist and lawyer Glenn Greenwald, one of Snowden's first contacts after his flight from the NSA, commented: "Even if you think that you're the kind of person who does not have things to hide, just living in a world where you think you're being watched and recorded it changes your behavior from being a free individual. I would submit, and I don't think that it's in dispute, that we are far closer to the tyrannical model than we are the free model." -
Obama Authorizes Penalties For Foreign Cyber Attackers
An anonymous reader writes President Barack Obama has today signed an executive order extending the U.S. administration's power to respond to malicious cyberattacks and espionage campaigns. The order enforces financial sanctions on foreign hackers who action attacks against American businesses, institutions and citizens. It will enable the secretary of the Treasury, along with the attorney general and secretary of State, to inflict penalties on cyber criminals behind hacking attacks which "create a significant threat to U.S. national security, foreign policy or economic health or financial stability of the United States," Obama said. Sanctions could include freezing of assets or a total ban on commercial trade. -
Notel Media Player Helps North Koreans Skirt Censorship
An anonymous reader writes A small portable media device, costing roughly $50, is allowing North Koreans to access and view foreign media despite tight government censorship, according to a Reuters report. The 'Notel', a mashup of notebook and television, is being described as a symbol of change in the repressed society. Used to watch DVDs and shared content from USB sticks and SD cards, the media player can be easily concealed and transported among families and friends. According to correspondents in the region, as many as half of all urban North Korean households have a notel and are swapping a broad range of banned media such as soaps and TV dramas from South Korea and China, Hollywood blockbusters, and news clips — all of which is strictly forbidden by Pyongyang law. -
German Auto Firms Face Roadblock In Testing Driverless Car Software
An anonymous reader writes As nations compete to build the first operational autonomous car, German auto-manufacturers fear that current domestic laws limit their efforts to test the appropriate software for self-driving vehicles on public roads. German carmakers are concerned that these roadblocks are allowing U.S. competitors, such as Google, to race ahead in their development of software designed to react effectively when placed in real-life traffic scenarios. Car software developers are particularly struggling to deal with the ethical challenges often raised on the road. For example when faced with the decision to crash into a pedestrian or another vehicle carrying a family, it would be a challenge for a self-driving car to follow the same moral reasoning a human would in the situation. 'Technologically we can do fully automated self-driving, but the ethical framework is missing,' said Volkswagen CEO Martin Winterkorn. -
European Commission Proposes "Digital Single Market" and End To Geoblocking
An anonymous reader writes A new initiative from the European Commission proposes a reformed "single digital market", addressing a number of issues that it sees as obstructions to EU growth, including geoblocking — where services such as BBC's iPlayer are only available to IP addresses within the host country — and the high cost of parcel delivery and administration of disparate VAT rates across the member states. The ramifications of many of the proposals within the Digital Single Market project extend to non-EU corporations which have built their business model on the current isolationism of member state markets. -
Leaked Snowden Docs Show Canada's "False Flag" Operations
An anonymous reader writes Documents leaked by NSA whistleblower Edward Snowden to the Canadian Broadcasting Corporation and The Intercept show the extent to which Communications Security Establishment Canada (CSEC) cooperates with the NSA — and perhaps most interestingly details CSEC's "false flag" operations, whereby cyberattacks are designed and carried out with the intention of attribution to another individual, group or nation state. The revelations come in the midst of Canadian controversy regarding the C-51 anti-terrorism bill. -
Internet of Things Endangered By Inaccurate Network Time, Says NIST
An anonymous reader writes: Current standards of network timekeeping are inadequate to some of the critical systems that are being envisaged for the Internet of Things, according to a report (PDF) by the National Institute of Standards and Technology (NIST). The report says, "A new economy built on the massive growth of endpoints on the internet will require precise and verifiable timing in ways that current systems do not support. Applications, computers, and communications systems have been developed with modules and layers that optimize data processing but degrade accurate timing." NIST's Chad Boutin likens current network accuracy to an attempt to synchronize watches via the postal system, and suggests that remote medicine and self-driving cars will need far higher standards in order not to put lives at risk. He says, "modern computer programs only have probabilities on execution times, rather than the strong certainties that safety-critical systems require." -
Tag Heuer Partners With Google and Intel To Create Luxury Apple Watch Rival
An anonymous reader writes Luxury Swiss watchmaker Tag Heuer has announced it will be designing a smartwatch in partnership with U.S. tech giants Google and Intel. The watch is to rival similar devices in the consumer wearables market, specifically the much-anticipated Apple Watch. Tag is the first watchmaker to join with Google, however it is thought the deal will also welcome collaborations with other high-quality LVMH brands, such as Hublot and Zenith. The watch will be available toward the end of the year, with price structures and functionality details announced shortly before its release. -
Google 'Experts' To Screen Android Apps For Banned Content
An anonymous reader writes Google has announced that it will start an official human-based screening process for all of the apps featured in its Google Play store, in a bid to "better protect the community" and "improve the app catalogue." The search giant revealed yesterday that a "team of experts" would be reviewing apps and all updates offered across the Google Play platform for those which violate Google's developer policies. The team will also give direct feedback to developers on what they need to do in order to fix their apps before they can be listed on the Store. A dedicated review page will allow developers to gain further "insight into why apps were rejected or suspended," as well as offering them the opportunity to "easily fix and resubmit their apps" for those who have violated minor regulations. -
Microsoft Offers Pirates Amnesty and Free Windows 10 Upgrades
An anonymous reader writes: Microsoft will make Windows 10 available as a free upgrade even to pirated copies of other Windows operating systems in China. Terry Myerson of Microsoft's operating systems unit made the announcement at the WinHEC technology conference in Shenzhen, China, and then told Reuters, "We are upgrading all qualified PCs, genuine and non-genuine, to Windows 10." Microsoft has a history of attempting to tackle massive and rising software piracy rates in Asia and developing countries, and periodically offers low-cost "licence amnesties" to the worst-offending countries, such as Indonesia and Kenya. Update: 03/18 14:59 GMT by S : Microsoft has clarified that the free upgrade will be offered for unlicensed copies of Windows worldwide, not just in China. -
Data Research Reveals When Taking a Yellow Cab Is Cheaper Than an Uber
An anonymous reader writes A team of data scientists have come up with a system to identify times when regular yellow taxis are cheaper alternatives to an Uber [in New York]. Researchers from the University of Cambridge and the University of Nanmur in Belgium have compared a broad dataset of both yellow taxi and Uber fares in New York and have discovered that for a trip costing less than $35 Uber is often the most expensive option. The data scientists were able to reach this conclusion by comparing trip and fare data for each yellow taxi ride taken in 2013 and entering it into Uber's fare query system. Prices were taken from Uber's lowest-cost service Uber X and the NYC Taxi and Limousine Commission. -
Ex-NSA Researcher Claims That DLL-Style Attacks Work Just Fine On OS X
An anonymous reader writes Ex-NSA and NASA researcher Patrick Wardle claims to have developed a reliable technique of Shared Library replacement which renders Apple's OSX operating system just as vulnerable to exploitation as Windows has been (via its 'DLL' shared libraries) for years. Speaking at CanSecWest, Wardle explained that Apple's refusal to encrypt software downloads via its App Store allows an attacker on the same network to inject a malicious 'dylib' (shared library) without altering the hash of the legitimate-but-vulnerable software, thereby leaving the Developer ID signature intact. Wardle ran a crafted Python script on a typical Mac and discovered 150 dylib-dependent applications, including Apple's own Xcode developer environment — revealed last week by Edward Snowden to be a priority target for the NSA due to its ability to propagate compromised software. -
Laser Imaging Drone To Hunt Out Unexploded Bombs In War-Torn Nations
An anonymous reader writes Aerial imaging firm Arch Aerial has discussed its hopes to deploy drones to map out mine fields and locations littered with unexploded bombs from historical warfare. CEO Ryan Baker suggested that his company wants to start the program in Laos, the world's most heavily bombed country. The 'octocopter' technology will work using a remote laser imaging platform called LIDAR to analyze fields and identify sites where UXO is likely to be uncovered. The sensor technology LIDAR is a crucial system in the design as it can easily see through vegetation and creates detailed maps of the terrain. Surveyors will be then be able to use the maps to look for topographical signs which suggest past bombing activity. -
IBM Reported To Be Developing Blockchain-Based Currency Transaction System
An anonymous reader writes: According to a Reuters source, IBM is working with the U.S. Federal Reserve and other central banks to develop a digital currency transaction system using the same blockchain technology that underpins Bitcoin — but which will deal with existing national currencies. The anonymous source says: "These coins will be part of the money supply...It's the same money, just not a dollar bill with a serial number on it, but a token that sits on this blockchain," Despite vocal community protest about the potential "co-opting" of a geographically-neutral cryptocurrency in favor of a centrally-controlled distributed transaction ledger, the IBM project, if true, is only one among hundreds seeking to leverage the blockchain for new transaction systems. -
NSA Director Argues For "Red Button" Autonomy Against Unattributed Cyber-Attacks
An anonymous reader writes U.S. Navy Adm. Michael S. Rogers — director of the National Security Agency and Commander of United States Cyber Command (USCYBERCOM) — has suggested that cyber-attacks can begin and escalate so quickly that USCYBERCOM would need powers to retaliate immediately, without (as it is currently obliged) referring the matter to the United States Strategic Command. In testimony to the "House Armed Services Committee on cyber operations and improving the military's cybersecurity posture" on March 4th, Adm. Rogers argues for "development of defensive options which do not require full attribution to meet the requirements of law and international agreement." -
Energy-Generating Fabric Set To Power Battery-Free Wearables
An anonymous reader writes A team of researchers in Korea and Australia have developed a flexible fabric which generates power from human movement – a breakthrough which could replace batteries in future wearable devices. The effect of the fabric's nanogenerators mirrors static electricity with the two fabrics repeatedly brushing against each other and stealing electrons from the one another – this exchange creates energy from the wearer's activity without the need for an external power source. During testing, the researchers demonstrated the nanogenerator powering a number of devices such as LEDs, a liquid crystal display, as well as a keyless car entry system embedded in a nanogenerator 'power suit'. -
Microsoft Closes Gap Between Windows 10 and Xbox One With "Crossplay" Plans
An anonymous reader writes In its attempt to make console gaming more accessible, Microsoft has announced that it will be developing universal apps which can run across Xbox One and Windows 10, as well as smartphones and other mobile devices using the upcoming OS. At the Game Developers Conference in San Francisco yesterday, Phil Spencer, head of Microsoft's video games branch, said that the end-goal was to allow people to play games wherever they are over whichever platform they wish to use. Microsoft also announced that an adapter was currently being developed to hook up wireless Xbox One controllers to PCs. This latest move from the tech giant shows its push to grapple back its position in the mobile computing revolution, as the booming smartphone and tablet market shadows its longstanding desktop and laptop business. -
Firefox 37 To Check Security Certificates Via Blocklist
An anonymous reader writes The next version of Firefox will roll out a 'pushed' blocklist of revoked intermediate security certificates, in an effort to avoid using 'live' Online Certificate Status Protocol (OCSP) checks. The 'OneCRL' feature is similar to Google Chrome's CRLSet, but like that older offering, is limited to intermediate certificates, due to size restrictions in the browser. OneCRL will permit non-live verification on EV certificates, trading off currency for speed. Chrome pushes its trawled list of CA revocations every few hours, and Firefox seems set to follow that method and frequency. Both Firefox and Chrome developers admit that OCSP stapling would be the better solution, but it is currently only supported in 9% of TLS certificates. -
Deutsche Telecom Calls For Google and Facebook To Be Regulated Like Telcos
An anonymous reader writes Tim Hoettges, the CEO of the world's third-largest telecoms company, has called for Google and Facebook to be regulated in the same way that telcos are, declaring that "There is a convergence between over-the-top web companies and classic telcos" and "We need one level regulatory environment for us all." The Deutsche Telekom chief was speaking at Monday's Mobile World Congress, and further argued for a loosening of the current regulations which telcos operate under, in order to provide the infrastructure development that governments and policy bodies are asking of them. Hoettges' imprecation comes in the light of news about the latest Google Dance — an annual change in ranking criteria which boosts some businesses and ruins others. The case for and against regulating Google-level internet entities comes down to one question: who do you trust to 'not be evil'? -
Why We Should Stop Hiding File-Name Extensions
An anonymous reader writes 14 years after the Anna Kournikova virus took advantage of users' ignorance about file-name extensions in order to wreak worldwide havoc, virus writers and hackers are still taking advantage of the tendency of popular consumer operating systems to hide file-name extensions: Windows users still need to activate extension visibility manually – even though email-transmitted viruses depend most on less savvy users who will never do this. Additionally applications on even the latest versions of Apple's OSX operating system still require the user to 'opt in' to including a file-name extension during an initial save. In looking at some of the eccentricities of the modern user experience, this article argues that it might be time to admit that users need to understand, embrace and responsibly use the only plain-text, obvious indicator of what a file actually is. -
US Govt and Private Sector Developing "Precrime" System Against Cyber-Attacks
An anonymous reader writes A division of the U.S. government's Intelligence Advanced Research Projects Activity (IARPA) unit, is inviting proposals from cybersecurity professionals and academics with a five-year view to creating a computer system capable of anticipating cyber-terrorist acts, based on publicly-available Big Data analysis. IBM is tentatively involved in the project, named CAUSE (Cyber-attack Automated Unconventional Sensor Environment), but many of its technologies are already part of the offerings from other interested organizations. Participants will not have access to NSA-intercepted data, but most of the bidding companies are already involved in analyses of public sources such as data on social networks. One company, Battelle, has included the offer to develop a technique for de-anonymizing BItcoin transactions (pdf) as part of CAUSE's security-gathering activities. -
How Walking With Smartphones May Have Changed Pedestrian Etiquette
An anonymous reader writes The phenomenon of 'distracted walking' — pedestrians who walk while using smartphones — has raised civic attention in the last few years, with Utah issuing fines and cities in China creating dedicated 'smartphone lanes' for walkers who need to keep up with Whatsapp on the move. This article argues that smartphone users have become so accustomed to other people getting out of their way that they will no longer negotiate for sidewalk space even when not using their phones. -
Superfish Security Certificate Password Cracked, Creating New Attack Vector
In a followup to today's news about junk software included with Lenovo computers, an anonymous reader writes Robert Graham at Errata Security has published an article announcing his success in extracting the SuperFish self-signed security certificate from the adware which has caused Chinese computer manufacturer Lenovo such embarrassment in the last day. Since SuperFish is already capable of carrying out man-in-the-middle attacks over secure connections on the Lenovo machines which use the certificate, the disclosure of the certificate's password presents hackers with a 'a pre-installed hacking environment' which would be difficult to arrange by other means. The password, "komodia," is also the name of the Komodia Redirector framework, which allows its clients to manipulate TCP/IP network sessions "with a few simple clicks." -
Government, Military and Private Sector Fighting Over Next-Gen Cyber-Warriors
An anonymous reader writes Both the U.S. Army and Britain's intelligence agency GCHQ launched new initiatives to address their severe shortfalls in cyber-security specialists. The United States Army Reserve launched the "cyber private public partnership" (Cyber P3) on Capitol Hill, which will give reservists the opportunity to train as cyber-warriors in six U.S. universities, in partnership with 11 employers. In the UK GCHQ announced an "Insiders Summer School", where first and second-year computer science undergraduates will be paid to attend a ten week intensive cyber-training course, culminating in a live display of their online and hacking acumen. The Government Accountability Office estimates a shortfall of 40,000 cyber security operatives, and with multiple branches of government in several western countries fighting each other (and the private sector, and the criminal arena) for the patronage of computer science students, cyber-security is looking to be the safest career path an undergraduate could pursue. -
Oregon Residents Riled Over Virtually Staff-free Data Centers Getting Tax-breaks
An anonymous reader writes: The population of Hillsboro, Oregon is becoming vocal about the state's enterprise zone program offering enormous tax concessions to companies setting up data centers in the region — even though the five-year deals on offer only require data center operators to employ one person. That's exactly as many people as one DC plant, Infomart Portland, employs full-time, yet it gets more tax relief than highly-staffed enterprise zone neighbor Solarworld. The current influx of data centers to Hillsboro have only generated seven jobs to date. More installations are coming, and all Hillsboro residents are seeing is space taken up that might have gone to businesses that give something of benefit to the community. -
Seoul City To Introduce Uber Rival Premium Taxi Service
An anonymous reader writes Seoul city has today announced that it will be launching a luxury taxi service this summer to rival the global cab-hailing app Uber, adding to the obstacles that the U.S.-based firm is currently facing in the Asian market. The government's move comes after the country's transport department rejected a proposal from Uber last week for a new driver registration, and enforced its stance against Uber operating in the area. The new premium service will be introduced in Seoul city in August with 100 luxury and mid-sized saloon cars. "We will provide a premium tax service which excels that of Uber..." the Seoul government said in a statement. It stated that a taxi association would be partners of the scheme to help establish the service, but added no detail regarding which company they would be working with. -
US Gas Pump Hacked With 'Anonymous' Tagline
An anonymous reader writes Researchers at Trend Micro have uncovered a gas pump in the United States whose ID has been changed from 'DIESEL' to 'WE_ARE_LEGION' — the call-sign of the Anonymous hacking group. Following up recent revelations regarding the vulnerability of gas pump systems to online attackers, the researchers found 1,515 completely unprotected gas pump monitoring devices via the Shodan device-based search engine. The report notes that the exposed devices are capable of being protected via six-digit pins, but this security measure is not being used. The report concludes: "Our investigation shows that the tampering of an Internet-facing device resulted in a name change. But sooner or later, real world implications will occur, causing possible outages or even worse." -
Russia Seeking To Ban Tor, VPNs and Other Anonymizing Tools
An anonymous reader writes Three separate Russian authorities have spoken out in favor of banning online anonymizing tools since February 5th, with particular emphasis on Tor, which — despite its popularity with whistle-blowers such as Edward Snowden and with online activists — Russia's Safe Internet League describes as an 'Anonymous network used primarily to commit crimes'. The three authorities involved are the Committee on Information Policy, Information Technologies and Communications, powerful Russian media watchdog Roskomnadzor and the Safe Internet League, comprising the country's top three network providers, including state telecoms provider Rostelecom. Roskomnadzor's press secretary Vadim Roskomnadzora Ampelonsky describes the obstacles to identifying and blocking Tor and VPN traffic as "difficult, but solvable." -
DOT Warns of Dystopian Future For Transportation
An anonymous reader writes The U.S. Department of Transportation has issued a 300-page PDF outlining the grim future of transportation infrastructure in North America over the next thirty years, and inviting debate on the issue. The report presents a vision of 2045 with LA-style traffic jams in Nebraska, trains too full to pick up any more passengers and airports underwater due to climate change — all in a climate of chronic under-investment, even at levels needed to maintain existing transport infrastructure. Among possible solutions outlined are self-driving cars using vehicle-to-vehicle (V2I) crash-avoidance technologies, such as those currently in development by Google — and in fact transportation secretary Anthony Foxx was joined by Google CEO Eric Schmidt at the launch of DOT's "Beyond Traffic" initiative. -
Alibaba Tests Drone Delivery Service In China
An anonymous reader writes: Following the lead of online retail giant Amazon, Chinese e-commerce group Alibaba has today tested its first drone delivery service. Asia's largest e-retailer promises to deliver ginger tea within an hour to customers across its flagship consumer-to-consumer marketplace Taobao, which holds an estimated 90 per cent market share in the country. The remote-controlled black and silver drones are helicopter-like in design and carry a white box containing the product. For now the service is limited to a three-day test in three of China's largest mega-cities, Beijing, Shanghai, and Guangzhou, and confined to just one tea brand from one merchant. The trial will be applied up to a limit of 450 tea deliveries. -
BMW Patches Security Flaw Affecting Over 2 Million Vehicles
An anonymous reader writes BMW has fixed a security bug which left 2.2 million cars, including models from Rolls Royce and Mini, exposed to hackers. The flaw was discovered in vehicles using BMW's ConnectedDrive software, which runs from an installed on-board Sim card. Via the smartphone app, owners can remotely control a number of functions including door locks, air conditioning and sounding the horn. Researchers from the German motorist association ADAC identified the flaw which allowed the system to connect to fake mobile phone networks, enabling hackers to remotely control the Sim card. -
US Army Releases Code For Internal Forensics Framework
An anonymous reader writes: The U.S. Army Research Laboratory in Maryland has released on GitHub a version of a Python-based internal forensics tool which the army itself has been using for five years. Dshell is a Linux-based framework designed to help investigators identify and examine compromised IT environments. One of the intentions of the open-sourcing of the project is to involve community developers in the creation of new modules for the framework. The official release indicates that the version of Dshell released to Github is not necessarily the same one that the Army uses, or at least that the module package might be pared down from the Army-issued software. -
Former NATO Nuclear Bunker Now an 'Airless' Unmanned Data Center
An anonymous reader writes A German company has converted a 1960s nuclear bunker 100 miles from network hub Frankfurt into a state-of-the-art underground data center with very few operators and very little oxygen. IT Vision Technology (ITVT) CEO Jochen Klipfel says: 'We developed a solution that reduces the oxygen content in the air, so that even matches go outIt took us two years'. ITVT have the European Air Force among its customers, so security is an even higher priority than in the average DC build; the refurbished bunker has walls 11 feet thick and the central complex is buried twenty feet under the earth. -
Moscow To Track Cell-phone Users In 2015 For Traffic Analysis
An anonymous reader links to this story at The Stack (based on this translated report) that "The Moscow authorities will begin using the signal from Muscovites' cell-phones in 2015 to research patterns of traffic and points of congestion, with a view to changes in travel infrastructure including roads, the Moscow metro and bus services. The tracking, which appears to opt all users in unilaterally, promises not to identify individual cell-phone numbers, and will use GSM in most cases, but also GPS in more densely-constructed areas of the old city. The system is already in limited use on the roads, but will be extended to pedestrians and subway users in 2015. The city of 11.5 million people has three main cell providers, all of whom cooperate fully with authorities' request for information. A representative of one, Beeline, said: "We prepare reports that detail where our subscribers work, live, move, and other aspects." -
'Be My Eyes' App Crowdsources Help For the Blind
An anonymous reader writes: A new not-for-profit app, Be My Eyes, aims to help the visually-impaired by connecting them with volunteer users who can support them in their daily lives via live video calls. Once downloaded, Be My Eyes asks the user to identify as blind or sighted, to see if you require help or are offering it. When a blind person requests assistance the app scans the system for an available volunteer. The blind user connects with the volunteer over a video call and points to the item they would like described. Be My Eyes was created by Hans Jørgen Wiberg, a visually-impaired entrepreneur, at a startup event. Wiberg teamed up with Robocat, the Danish software studio behind Haze and Thermo, to make his vision a reality. -
US/UK Will Stage 'Cyber-Attack War Games' As Pressure Against Encryption Mounts
An anonymous reader writes: British prime minister David Cameron is currently visiting Washington to discuss the future of cyber-security in Britain and North America. The leaders have announced that their respective intelligence agencies will mount ongoing cyber-attack "war games" starting this summer in an effort to strengthen the West's tarnished reputation following the Sony hacking scandal. Somewhat relatedly, a recently-leaked Edward Snowden document show the NSA giving dire warnings in 2009 of the threat posed by the lack of encrypted communications on the internet. -
Bitcoin Volatility Puts Miners Under Pressure
An anonymous reader writes "The virtual currency Bitcoin lost 21 per cent of its value yesterday, equating to a total loss this year of 44 per cent. Reports have suggested that this rapid fall is squeezing computer supporting systems and is raising alarm about its future viability. Bitcoin's value fell to $179.37, 85 per cent lower than its record peak of $1,165 at the end of 2013. In total, nearly $11.3bn has been lost in Bitcoin's value since its 2013 high. The decline has raised concern for Bitcoin 'miners' who support the transactions made in the digital currency, and whose profits become squeezed as its price falls against traditional currencies." The Coindesk article in the linked story gives a blow-by-blow on yesterday's valuation drop; right now, Bitcoin has jumped back up and stands at just over $216. -
Asus Wireless Routers Can Be Exploited By Anyone Inside the Network
An anonymous reader writes A currently unpatched bug in ASUS wireless routers has been discovered whereby users inside a network can gain full administrative control, according to recent research conducted by security firm Accuvant. Although the flaw does not allow access to external hackers, anyone within the network can take administrative control and reroute users to malicious websites, as well as holding the ability to install malicious software. The vulnerability stems from a poorly coded service, infosvr, which is used by ASUS to facilitate router configuration by automatically monitoring the local area network (LAN) and identifying other connected routers. Infosvr runs with root privileges and contains an unauthenticated command execution vulnerability, in turn permitting anyone connected to the LAN to gain control by sending a user datagram protocol (UDP) package to the router. In relevant part: The block starts off by excluding a couple of OpCode values, which presumably do not require authentication by design. Then, it calls the memcpy and suspiciously checks the return value against zero. This is highly indicative that the author intended to use memcmp instead. That said, even if this check was implemented properly, knowing the device’s MAC address is hardly sufficient authentication,” said Drake. Here are the technical details at GitHub. -
Study: 15 Per Cent of Business Cloud Users Have Been Hacked
An anonymous reader writes Recent research has identified that only one in ten cloud apps are secure enough for enterprise use. According to a report from cloud experts Netskope, organizations are employing an average of over 600 business cloud apps, despite the majority of software posing a high risk of data leak. The company showed that 15% of logins for business apps used by organizations had been breached by hackers. Over 20% of businesses in the Netskope cloud actively used more than 1,000 cloud apps, and over 8% of files in corporate-sanctioned cloud storage apps were in violation of DLP policies, source code, and other policies surrounding confidential and sensitive data. Google Drive, Facebook, Youtube, Twitter and Gmail were among the apps investigated in the Netskope research. -
South Korean Power Plants To Conduct Cyber-Attack Drills Following Hack
An anonymous reader writes South Korea's nuclear operator has been targeted in a cyber-attack, with hackers threatening people to 'stay away' from three of the country's nuclear reactors should they not cease operations by Christmas. The stolen data is thought to be non-critical information, and both the company and state officials have assured that the reactors are safe. However, KHNP has said that it will be conducting a series of security drills over the next two days at four power plants to ensure they can all withstand a cyber-attack. The hacks come amid accusations by the U.S. that North Korea may be responsible for the punishing hack on Sony Pictures. Concerns have mounted that Pyongyang may initiate cyber strikes against industrial and social targets in the U.S. and South Korea. -
RFID-Blocking Blazer and Jeans Could Stop Wireless Identity Theft
An anonymous reader writes A pair of trousers and blazer have been developed by San Francisco-based clothing company Betabrand and anti-virus group Norton that are able to prevent identity theft by blocking wireless signals. The READY Active Jeans and the Work-It Blazer contain RFID-blocking fabric within the pockets' lining designed to prevent hacking through radio frequency identification (RFID) signals emitted from e-passports and contactless payment card chips. According to the clothing brand, this form of hacking is an increasing threat, with "more than 10 million identities digitally pick pocketed every year [and] 70% of all credit cards vulnerable to such attacks by 2015." -
Microsoft Gets Industry Support Against US Search Of Data In Ireland
An anonymous reader writes Tech giants such as Apple and eBay have given their support in Microsoft's legal battle against the U.S. government regarding the handing over of data stored in an Irish datacenter. In connection with a 2014 drugs investigation, U.S. prosecutors issued a warrant for emails stored by Microsoft in Ireland. The firm refused to hand over the information, but in July was ordered by a judge to comply with the investigation. Microsoft has today filed a collection of letters from industry supporters, such as Apple, eBay, Cisco, Amazon, HP, and Verizon. Trade associations including the U.S. Chamber of Commerce and Digital Rights Ireland have also expressed their support. -
Apple Antitrust Case Finds New Consumer Plaintiff
An anonymous reader writes Class action against Apple is set to continue after 65-year-old amateur figure skater Barbara Bennett decided she would volunteer to represent consumers in the faltering antitrust case. U.S. district judge Yvonne Gonzalez-Rogers is reportedly satisfied that Bennett qualifies as a class member, telling attorneys that they 'were on the right track.' Bennett offered to volunteer in the case after reading an online news story which suggested that the suit was floundering due to a lack of a named plaintiff after the last plaintiff was disqualified earlier this week. -
New Compilation of Banned Chinese Search-Terms Reveals Curiosities
An anonymous reader writes Canada's Citizen Lab has compiled data from various research projects around the world in an attempt to create a manageable Github repository of government-banned Chinese keywords in internet search terms and which may appear in Chinese websites. Until now the study of such terms has proved problematic due to disparate research methods and publishing formats. A publicly available online spreadsheet which CCL have provided to demonstrate the project gives an interesting insight into the reactive and eccentric nature of the Great Blacklist of China, as far as outside research can deduce. Aside from the inevitable column listings of dissidents and references to government officials and the events in Tiananmen Square in 1989, search terms as basic as "system" and "human body" appear to be blocked. -
Microsoft Quietly Starts Accepting Bitcoin As Payment Method
An anonymous reader writes A new page in the help guide in the payment information of Microsoft's website reveals that the Redmond giant is now accepting Bitcoin as a payment method for products and services on Windows, Windows Phone and Xbox. Currently the payments must go through to credit a Microsoft Wallet account, and the service is initially only available to U.S. users. But the wording of the new page combines with an expansive year for Microsoft and a number of positive statements about Bitcoin from Bill Gates to indicate that this first step is more than just an experiment. Microsoft is now the largest commercial entity accepting the Bitcoin currency, which it processes via the BitPay system, thus protecting the company from fluctuations in the value of Bitcoin. Also at CNN Money. -
Sony Hacks Continue: PlayStation Hit By Lizard Squad Attack
An anonymous reader writes Hacker group Lizard Squad has claimed responsibility for shutting down the PlayStation Network, the second large scale cyber-attack on the Sony system in recent weeks. Although apparently unrelated, the outage comes just weeks after the much larger cyber-attack to the tech giant's film studios, Sony Pictures, which leaked confidential corporate information and unreleased movies.The group claiming to have taken down PSN today, Lizard Squad, first appeared earlier this year with another high-profile distributed denial of service attack on Xbox Live and World of Warcraft in August. The hacker collective claimed that this attack was just a 'small dose' of what was to come over the Christmas period. -
UK Announces Hybrid Work/Study Undergraduate Program To Fill Digital Gap
An anonymous reader writes The UK's Digital Economy Minister Ed Vaizey today revealed a new scheme where undergraduates will be able to avoid student fees and student loans by working for companies for three years whilst simultaneously undertaking academic studies with participating universities, resulting in a degree at the end of their successful involvement in the scheme. The British government will fund two-thirds of the cost of tuition and the host employer the remainder. The "Digital Apprenticeship" scheme will remunerate students at an unspecified level of pay, and though details are currently sketchy, is reported to obviate the need for student loans. The initiative is targeting the skills gap in the digital sector, particularly in the field of web-development and technical analysis. -
Auto Industry Teams Up With Military To Stop Car Hacking
An anonymous reader writes: A team of hackers is collaborating with military and industry groups to develop cyber security defenses for commercially available cars, in response to a growing threat from criminals and terrorists. In the U.K., hackers are now responsible for a third of car thefts in London and there are fears that while technology is progressing, older models will remain vulnerable to attack. Although there have been no reported instances of a car being completely commandeered outside of controlled conditions, during tests hackers come out on top every time – unlocking car boots, setting off windscreen wipers, locking brakes, and cutting the engine. -
Military Laser/Radio Tech Proposed As Alternative To Laying Costly Fiber Cable
An anonymous reader writes "Californian comm-tech company Aoptix is testing new laser+radio hybrid communications technology with three major U.S. internet carriers. The equipment required can be bolted onto existing infrastructure, such as cell-tower masts, and can communicate a 2gbps stream over 6.5 miles. The system was developed over 10 years at a cost of $100 million in conjunction with the Air Force Research Laboratory, and the military implementation of it is called Aoptix Enhanced Air Ground Lasercom System (EAGLS). The laser component of the technology uses a deformable mirror to correct for atmospheric distortion over the mast-hop, in real-time. The laser part of the system is backed-up by a redundant radio transmitter. The radio component has low attenuation in rainy conditions with large refracting raindrops, while the laser is more vulnerable to dense fog. The system, which features auto-stabilization to compensate for cell-tower movement and is being proposed as an alternative to the tremendous cost p/m of laying fiber cable, is being tested in Mexico and Nigeria in addition to the three ISP trials.