New leak may show if you were hacked by the NSA | Ars Technica: "Shadow Brokers—the name used by a person or group that created seismic waves in August when it published some of the National Security Agency's most elite hacking tools—is back with a new leak that the group says reveals hundreds of organizations targeted by the NSA over more than a decade."

Labels: security policy

Lad cuffed after iOS call exploit knocks out Arizona 911 center • The Register: "The flood of calls from smartphones and tablets was eventually traced to Desai's personal site hosted in San Francisco, California; the cops managed to get the plug pulled on the site. The teen was arrested, taken to jail, and booked on three charges of computer tampering. A search warrant was also carried out at his home."

Labels: malware

Search engine results increasingly poisoned with malicious links • The RegisterThe number of infected results has been increasing year by year since 2013 despite the application of multiple tools and technologies designed to exclude dodgy links, according to a study by independent anti-virus testing outfit AV-TEST.org.

Labels: security fail, security flaw, security policy

How security flaws work: SQL injection | Ars TechnicaThe earliest description of these attacks probably came in 1998, when security researcher Jeff Forristal, writing under the name "rain.forest.puppy," wrote about various features of Microsoft's IIS 3 and 4 Web servers in the hacker publication Phrack.

Labels: security exploit, security flaw, SQL injection

AMD reveals Radeon Pro 400 series GPU specs, as used in new MacBook Pro | Ars TechnicaAMD has released a smattering of specs for the Radeon Pro 400 series on its Creators with Radeon Pro website, which show the Radeon Pro 450 used in the MacBook Pro to have a peak FP32 performance of around one teraflop. That's under half the 2.2 teraflops of the desktop-based RX 460 and miles behind the performance of Nvidia's Pascal-based laptop GPUs.

Labels: mac os x

How Google's Project Zero made Apple refactor its kernel • The Register: "It took eight months, apparently, because of a basic architectural feature of the kernel: calling target functions directly instead of via the MIG IPC (Mach interface generator inter process communication) layer is fast, but “there’s no central point where access to a resource can be cut off”."

Labels: security policy

“He’s not Edward Snowden,” lawyers for accused NSA contractor tell judge | Ars Technica: "Defense attorneys representing Harold Martin, the former National Security Agency contractor accused of stealing a vast quantity of classified materials, have asked a more senior judge to review the decision that kept their client in federal custody."

Labels: security policy

Every LTE call, text, can be intercepted, blacked out, hacker finds • The Register: "Ruxcon Hacker Wanqiao Zhang of Chinese hacking house Qihoo 360 has blown holes in 4G LTE networks by detailing how to intercept and make calls, send text messages and even force phones offline."

Labels: assumptions, security, stereotypes

Como–D'oh! Infosec duo exploits OCR flaw to nab a website's HTTPS cert • The Register: "Two European security researchers exploited Comodo's crappy backend systems to obtain a HTTPS certificate for a domain they do not own."

Labels: security leak, security policy, security research

Double-dip Internet-of-Things botnet attack felt across the Internet | Ars Technica: "The distributed denial of service attacks against dynamic domain name service provider Dyn this morning have now resurged. The attacks have caused outages at services across the Internet.

But this second wave of attacks appears to be affecting even more providers. According to Dale Drew, the chief security officer at Level 3 Communications, the attack is at least in part being mounted from a "botnet" of Internet-of-Things (IoT) devices."

Labels: DDOS

Acronis: Yep, we're using blockchain for backup now • The Register: "Acronis was reported as checking out Blockchain technology in May. It says Notary generates a time-stamped hash, or fingerprint, of protected data and stores it in digital currency house Ethereum, a public blockchain-based distributed computing platform. By comparing two fingerprints of the same data, Acronis Storage is able to verify immutability, authenticity, and integrity of stored data. Regrettably Ethereum suffered a hack in June, illustrating it's not that secure."

Labels: ludicrous speed

US internet users suffering under DDoS attacks on key DNS provider: "Starting early Friday, assailants started a massive distributed denial of service (DDoS) attack on DNS provider Dyn's servers. Major sites like The Verge, HBO Now, CNN, Imgur, Paypal, and Reddit are all affected to some extent."

Labels: security flaw

Z1 (computer) - Wikipedia: "The Z1 was the first freely programmable computer in the world which used Boolean logic and binary floating point numbers"

Labels: boolean logic, floating point

“Most serious” Linux privilege-escalation bug ever is under active exploit (updated) | Ars Technica: "The vulnerability, a variety known as a race condition, was found in the way Linux memory handles a duplication technique called copy on write. Untrusted users can exploit it to gain highly privileged write-access rights to memory mappings that would normally be read-only"

Labels: security policy

Microsoft Surface sales boom amid tepid iPad demand: "According to Microsoft's official numbers, Surface revenue came in at $926 million, up 38 percent compared to the same time last year. The surge for the quarter ending in September was largely due to a positive mix of premium devices sold, specifically top-tier Surface Book and Surface Pro 4 models."

Labels: surface suprise

2016 MacBook Pros with Intel Skylake | AppleInsider: "At this point, all signs are pointing to the inclusion of a MacBook Pro OLED touch-sensitive function bar replacing the traditional function keys. Both “Touch Bar” and “Control Strip” were seen in recent international trademark fillings given to AppleInsider."

Labels: mac

House wants “briefing as soon as possible” to grok how Yahoo spied | Ars Technica: "Rep. Ted Lieu, a Democrat who represents a portion of Los Angeles County, told Ars that this type of forced government request was "flat out unconstitutional." "

Labels: security policy

Twitter yanks data feeding tube out of police surveillance biz • The Register: "Twitter has suspended its commercial relationship with a company called Geofeedia – which provides social media data to law enforcement agencies so that they can identify potential miscreants.

The social media company announced the change through its Policy account on Tuesday morning following the publication of a report by the American Civil Liberties Union (ACLU) of California."

Labels: twitter

US government: Russia behind hacking campaign to disrupt US elections | Ars Technica: "The Office of the Director of National Intelligence and the Department of Homeland Security today jointly charged that the Russian government was responsible for directing a series of intrusions into the networks of US political organizations and state election boards."

Labels: security policy

Devs! Here's how to secure your IoT network, in, uh, 75 easy pages • The Register: "An in-depth security guidance report aimed at Internet of Things developers has been released by the Cloud Security Alliance."

Labels: linux vs. everyone else

Ex-NSA staffer reveals Mac malware that can hack your camera and mic: "Apple built a green LED light into every Mac with firmware-level protection that turns on anytime the sensor is tripped by unauthorized access. The security feature has become increasingly difficult for hackers to beat, but former NSA staffer Patrick Wardle found a way to piggyback on outgoing feeds and record them.

Labels: security exploit

Yahoo email surveillance linked to court order, Apple denies any similar requests: "Yahoo's tool to scan the contents of customer emails came as a result of a U.S. Foreign Intelligence Surveillance Court order last year, and was created by adapting otherwise benign software, a report indicated on Thursday."

Labels: security policy

Apple to automatically cram macOS Sierra into Macs – 'cos that worked well for Windows 10 • The Register: "This feature is usually switched on to receive security fixes and feature updates as soon as possible. Now it'll cause the Sierra upgrade to automatically download onto Macs running OS X El Capitan. Users can install the package by giving the go-ahead in a dialog box."

Labels: security policy

Suspect 27" iMac model with Intel Kaby Lake pops up at Best Buy: "At some point on Sunday night, the line item for a new iMac appeared. Carrying a model number of K0SC0LL/A, the Best Buy web page claims it has a seventh generation Intel Core i7 processor, a 27-inch display, 32GB memory, a 2TB fusion drive, and the AMD Radeon R9 M380 graphics chipset with 2GB of video RAM."

Labels: apple

More than 400 malicious apps infiltrate Google Play | Ars Technica: "Google Play was recently found to be hosting more than 400 apps that turned infected phones into listening posts that could siphon sensitive data out of the protected networks they connected to, security researchers said Thursday."

Labels: security flaw, security policy, security research

Crypto guru Matt Green asks courts for DMCA force field so he can safely write a textbook • The Register: "Assistant Professor Matthew Green has asked US courts for protection so that he can write a textbook explaining cryptography without getting sued under the Digital Millennium Copyright Act."

Labels: security flaw, security policy, security research