Jumping Ship
The initial process of getting your password manager configured with all of your login credentials can involve some serious work. If you decide to switch, you'll want a product that doesn't force you to go through the whole process again. LastPass 3.0 will import passwords from over 30 of its competitors; KeePass handles even more formats.
The initial process of getting your password manager configured with all of your login credentials can involve some serious work. If you decide to switch, you'll want a product that doesn't force you to go through the whole process again. LastPass 3.0 will import passwords from over 30 of its competitors; KeePass handles even more formats.
On the flip side, many password managers that don't have that kind of eclectic import skills can at least import from LastPass.
If you're starting from scratch, chances are good you've used your browser's built-in password management feature. LastPass and Dashlane will import those passwords, delete them from the browser, and turn off the browser's password management. Dashlane imports from Internet Explorer, Firefox, and Chrome; my1login handles those three plus Opera; LastPass goes for a clean sweep, importing from Safari along with the other four.
Beyond the Master Password
All of the password managers in this roundup support authentication using a master password. Since it's protection all of your other passwords, that one needs to be reallystrong. But if that's the only protection for your data, a crook who manages to steal your master password has the keys to your kingdom. The best password managers offer two-factor authentication.
All of the password managers in this roundup support authentication using a master password. Since it's protection all of your other passwords, that one needs to be reallystrong. But if that's the only protection for your data, a crook who manages to steal your master password has the keys to your kingdom. The best password managers offer two-factor authentication.
RoboForm and LastPass 3.0 Premium can be configured for fingerprint-based authentication. DashLane and LastPass support authentication via the Google Authenticator mobile app. Stealing the master password for hardware-based MyLOK Personal won't do a thief any good without also having the physical device.
The brand-new F-Secure Key is an interesting case. The free, one-device version only works on the device where you've installed it, so if you retain possession of the device, your passwords are safe. For $15.99 per year you can upgrade to a version that will sync any number of PC, Mac, Android, or iOS devices. However, adding a new device requires a transient code generated on your mobile device as well as the master password. Two-factor authentication is effectively the default with this product.
Password Capture and Replay
Most, but not all, password managers integrate with the browser to capture login credentials as you enter them and replay those credentials when you revisit the site. Password Genie 4.0, Dashlane, and LastPass go a step beyond, actively detecting and managing password change events and capturing credentials as you sign up for a new service.
Most, but not all, password managers integrate with the browser to capture login credentials as you enter them and replay those credentials when you revisit the site. Password Genie 4.0, Dashlane, and LastPass go a step beyond, actively detecting and managing password change events and capturing credentials as you sign up for a new service.
F-Secure Key, KeePass, and my1login are a bit different. With all three of these products, you initially enter your credentials manually. F-Secure Key requires a special keystroke to fill login forms. My1login replays passwords using a bookmarklet, so it works in any Java-equipped browser. KeePass offers an elaborate replay technology designed to confound keyloggers.
Quite a few password managers let you log in to your password storehouse from any browser, so you can look up credentials even when using someone else's computer. Among these are Norton Identity Safe, RoboForm Everywhere 7, and Keeper 5.0; LastPass and Dashlane also offer this feature. F-Secure, by contrast, doesn't allow any online access, considering it a potential security risk.
Form Filling and Personal Data
Given that most password managers already have the ability to fill your username and password into a login form, it's not surprising that many also serve as form fillers for personal data. RoboForm is probably the most flexible, but DashLane and LastPass will cleverly offer to capture what you've entered if they see you filling a form manually.
Given that most password managers already have the ability to fill your username and password into a login form, it's not surprising that many also serve as form fillers for personal data. RoboForm is probably the most flexible, but DashLane and LastPass will cleverly offer to capture what you've entered if they see you filling a form manually.
1Password for Windows stores more types of personal data than most, but not all of what it stores can be used to fill forms. Password Genie, LastPass, and Dashlane can store various types of ID data such as passports and driver's licenses. Dashlane even displays them realistically, for example, formatting the driver's license to match the state it's from.
Free Protection
KeePass and Norton Identity Safe are free, period. The free edition of LastPass has almost everything found in the premium; support for mobile devices is the big exception. You can use Dashlane or F-Secure for free on a single device; syncing requires the paid edition. The free edition of Password Box is fully functional, but stores only 25 passwords.
KeePass and Norton Identity Safe are free, period. The free edition of LastPass has almost everything found in the premium; support for mobile devices is the big exception. You can use Dashlane or F-Secure for free on a single device; syncing requires the paid edition. The free edition of Password Box is fully functional, but stores only 25 passwords.
You can use RoboForm Everywhere on all your devices for free, as long as you don't need more than 10 passwords. Basic features for my1login are free; going pro gets you the ability to categorize and organize your saved passwords. The pro edition also removes an advertising panel and adds the unrelated ability to post on multiple social media accounts at once.
Clearly there are plenty of free solutions, but even the paid solutions can be inexpensive. LastPass Premium costs a dollar a month, as does Password Box. You'll pay $15 each year for Password Genie, $16 for F-Secure Key, and $20 for Dashlane. That's not a lot, considering what they're protecting.
Security Checkup
Virtually every password manager will report the strength of your master password. Norton, RoboForm, KeePass, and quite a few others can also rate each of your stored passwords. And virtually every product will generate strong, random passwords for you on demand.
Virtually every password manager will report the strength of your master password. Norton, RoboForm, KeePass, and quite a few others can also rate each of your stored passwords. And virtually every product will generate strong, random passwords for you on demand.
LastPass and Dashlane take this concept a step beyond. Each offers a security report listing all of your passwords and rating the strength of each. They also report on duplicates—passwords you've used on more than one site. And they make it easy to upgrade all your passwords to improve security. Very impressive!
Source : PCMag
If you are running any current version of iOS 7, you’ll be able to take advantage of this tool. All you need to do is plug in, to your computer, disable your lock screen, run the program, and when all is said and done you’ll be jailbroken. Unfortunately the evasi0n team didn’t see fit to work with Saurik to include an updated version of Cydia or MobileSubstrate, but a quick glance at his twitter feed shows that the wait won’t be terribly long for those things.
 |
| Evasi0n Jailbreak for iOS7 |
This jailbreak from evasi0n includes something new for Chinese markets. Instead of Cydia, these users will have access to the all Chinese TaiG store. It is designed to offer services and apps that are more relevant in those parts of the world, much in the same way the CyanogenMod team intends to do soon with Tencent in the future. Some early poking around in this new store revealed some pirated apps, but the evasi0n team wrote a separate post explaining to everyone their plans for dealing with those apps moving forward.
If you’re all set to joilbreak, all of the tools are there for you to jump in and enjoy. If you’re more interested in waiting for Cydia to be updated and bugfixed, keep an eye on Saurik’s twitter account for more details.
via : Geek.com
he woman was shocked when she received two nude photos of herself by email. The photos had been taken over a period of several months – without her knowledge – by the built-in camera on her laptop.
The safest thing to do is to put a piece of tape on your camera.
 |
| iSight webcams |
Fortunately, the FBI was able to identify a suspect: her high school classmate, a man named Jared Abrahams. The FBI says it found software on Abrahams's computer that allowed him to spy remotely on her and numerous other women.
Abrahams pleaded guilty to extortion in October. The woman, identified in court papers only as C.W., later identified herself on Twitter as Miss Teen USA Cassidy Wolf. While her case was instant fodder for celebrity gossip sites, it left a serious issue unresolved:
Advertisement
Most laptops with built-in cameras have an important privacy feature – a light that is supposed to turn on any time the camera is in use. But Wolf said she never saw the light on her laptop. As a result, she had no idea she was under surveillance.
That wasn't supposed to be possible. While controlling a laptop camera remotely has long been a source of concern to privacy advocates, conventional wisdom said there was no way to deactivate the warning light.
Now research from Johns Hopkins University provides the first public confirmation that it's possible to do just that, and demonstrates how. While the research focused on MacBook and iMac models released before 2008, the authors say similar techniques would probably work on more recent computers from a wide variety of vendors.
In other words, if a laptop has a built-in camera, it's possible someone – whether the federal government or a malicious 19-year-old – could access it to spy on the user at any time, and the user would never know.
The iSight camera was designed to prevent this, said Stephen Checkoway, a computer science professor at Johns Hopkins and a co-author of the study. "Apple went to some amount of effort to make sure that the LED would turn on whenever the camera was taking images," Checkoway said. The 2008-era Apple products they studied had a "hardware interlock" between the camera and the light to ensure the camera couldn't turn on without alerting its owner.
But Checkoway and his co-author, Johns Hopkins University graduate student Matthew Brocker, were able to get around this security feature. That's because a modern laptop is actually several different computers in one package. "There's more than one chip on your computer," said Charlie Miller, a security expert at Twitter. "There's a chip in the battery, a chip in the keyboard, a chip in the camera."
MacBooks are designed to prevent software running on the MacBook's central processing unit (CPU) from activating the iSight camera without turning on the light. But researchers figured out how to reprogram the chip inside the camera, known as a micro-controller, to defeat this feature.
In a paper called "iSeeYou: Disabling the MacBook Webcam Indicator LED", Brocker and Checkoway describe how to reprogram the iSight camera's micro-controller to allow the camera to be turned on while the light stays off. Their research is under consideration for an upcoming academic security conference.
Attacks that exploit microcontrollers are becoming more common. "People are starting to think about what happens when you can reprogram each of those," Miller said. For example, he demonstrated an attack last year on the software that controls Apple batteries, which causes the battery to discharge rapidly, potentially leading to a fire or explosion. Another researcher was able to convert the built-in Apple keyboard into spyware using a similar method.
According to the researchers, the vulnerability they discovered affects "Apple internal iSight webcams found in earlier-generation Apple products, including the iMac G5 and early Intel-based iMacs, MacBooks and MacBook Pros until roughly 2008." While the attack outlined in the paper is limited to those devices, researchers like Charlie Miller suggest that the attack could be applicable to newer systems as well.
"There's no reason you can't do it – it's just a lot of work and resources, but it depends on how well [Apple] secured the hardware," Miller said.
Apple did not reply to requests for comment for this article. Brocker and Checkoway write in their report that they contacted the company on July 16. "Apple employees followed up several times but did not inform us of any possible mitigation plans," the researchers wrote.
The software used by Abrahams in the Wolf case is known as a Remote Administration Tool, or RAT. This software, which allows someone to control a computer from across the internet, has legitimate uses. For example, it can make it easier for a school's IT staff to administer a classroom full of computers.
Indeed, the devices the researchers studied were similar to MacBooks involved in a notorious case in Pennsylvania in 2008. Administrators at Lower Merion High School outside Philadelphia reportedly captured 56,000 images of students using the RAT installed on school-issued laptops. Students reported seeing a "creepy" green flicker that indicated that the camera was in use. That eventually led to a lawsuit.
But more sophisticated remote monitoring tools may already be able to suppress the warning light, said Morgan Marquis-Boire, a security researcher at the University of Toronto.
He points to commercial surveillance products such as Hacking Team and FinFisher that are marketed for use by governments. FinFisher is a suite of tools sold by a European firm called the Gamma Group. A company marketing document released by Wikileaks indicated that Finfisher could be "covertly deployed on the Target Systems" and enable, among other things, "Live Surveillance through Webcam and Microphone."
The Chinese government has also been accused of using RATs for surveillance purposes. A 2009 report from the University of Toronto described a surveillance program called Ghostnet that the Chinese government allegedly used to spy on prominent Tibetans, including the Dalai Llama. The authors reported that "web cameras are being silently triggered, and audio inputs surreptitiously activated," though it's not clear whether the Ghostnet software is capable of disabling camera warning lights.
But there is an easy way for users to protect themselves. Many security experts have used sticky tape, with the latest research perhaps proving why they shouldn't be considered paranoid.
"The safest thing to do is to put a piece of tape on your camera," Miller said.
 |
| Exploit of a Linux |
A security researcher with George Washington University, DiMino noticed several IP addresses attempting to hijack the Linux server by exploiting a now-patched PHP flaw that gave attackers the ability to remotely execute commands on vulnerable machines. DiMino was curious to know what the people behind the attacks intended to do with his machine, so he set up a "honeypot" box that, for research purposes, ran an older version of the Web development language.
The attackers' HTTP POST request contained a variety of commands that in short order downloaded a Perl script that was disguised as a PDF document file, executed it, and then deleted it. To ensure success, the attackers repeated the steps using curl, fetch, lwp-get requests. The Perl script was programmed to sleep for periods of time, presumably to prevent administrators from noticing anything amiss. Eventually, the compromised machine connected to an Internet relay chat channel, where it downloaded another script and executed it. Then he ran forensic software and snapped lots of screen shots so everyone could follow along.
In short order, the machine was running a host of apps installed by the attackers. Some of them hijacked the server hardware to perform the mathematical operations required to "mine" Bitcoins and another digital currency known as Primecoin. The server was also equipped with apps to perform denial-of-service attacks on other machines and to scan other machines for known vulnerabilities and exploit them when found.
"Across my honeypots, I'll see dozens of these a day, including Linux ELF [executable and linkable format] files, perlbots, and vintage shells," DiMino wrote in a blog post published Tuesday. "While these injected perl and shell scripts are typically considered the patio gnats of the Internet, more annoying than anything else, they do have the potential to cause considerable harm."
Not just for Windows anymore
DiMino's anatomy lesson is a graphic demonstration of recent advances in exploits for Linux. Once primarily the domain of machines running Windows, point-and-click exploits are used to commandeer machines so attackers can use them in online crime schemes. The increased horsepower and bandwidth available in many Linux servers often makes them more attractive than personal computers running Microsoft OSes. And as has always been the case, hijacked bots don't come with expensive electricity bills, and they often make it easy for criminals to cover their tracks.
The takeaway from the demonstration is just how important it is for admins working with any OS to stay on top of security patching. DiMino counsels admins to go a step further by learning how to actively monitor network activity on the machines they watch over. His blog post provides instructions for using the Volatility software framework to perform forensics on server memory. Among other things, it allows users to identify remote connections and the processes that initiate them.
Via : Ars Technica
 |
| Security |
The Washington Post's servers were penetrated by hackers who accessed employees' user names and password data in a breach that marked the third intrusion in as many years, the paper reported.
Security personnel still don't know the full extent of the loss, an article published Wednesday said. The intrusion was discovered by outside security consultant Mandiant, which reported it toWashington Post officials Wednesday. Compromised data includes employees' user names and passwords that were "stored in encrypted form," which typically means as a cryptographic hash. Postofficials, working under the assumption that a fair percentage of hashed passwords can be cracked, planned to direct all employees to change their passwords.
There's no evidence yet that subscriber information such as credit card data or home addresses was accessed. There was also no immediate sign that hackers had accessed the paper's publishing system, employee e-mail databases, or sensitive personal information belonging to workers. Wednesday's article cited a Washington Post official as saying investigators believe the intrusion lasted at most a few days.
Large international news organizations have become a common hacking target in recent years. Early this year, the New York Times said China-based attackers persistently intruded on its internal serversfor four months straight. In the process, they obtained password data for all of its reporters and other employees. The Wall Street Journal suffered its own intrusion around the same time. And in February, KrebsonSecurity reporter Brian Krebs uncovered an attack on Washington Post systems, also by suspected hackers from China. The NYT, Washington Post, Associated Press, and other news organizations have also been successfully targeted in other hacks, including a string of them by a group calling itself the Syrian Electronic Army.
Source : Ars Technica
 |
| Macbook Apple computers have a “hardware interlock” between the camera and the light that is supposed to ensure the camera can't be activated without alerting the user by lighting a tell-tale LED above the screen.
However Stephen Checkoway, a computer science professor at Johns Hopkins University and graduate student Matthew Brocker were able to circumvent this security feature by reprogramming the micro-controller chip inside the camera.
Normally, any program running on a MacBook’s central processing unit that takes images through Apple's iSight camera would turn on the tell-tale light. Brocker and Checkoway's reprogramming tactic allows the camera and it light to be activated independently, so that the camera can be running while the light is switched off.
The researchers have released proof-of-concept software to demonstrate the trick, including a paper , entitled iSeeYou: Disabling the MacBook Webcam Indicator LED. The study provides the first public confirmation that a sophisticated hacker tactic long suspected to be part of the playbook of intelligence agencies, feds and others is not only possible but relatively straightforward.
The same technique that allows us to disable the LED, namely reprogramming the firmware that runs on the iSight, enables a virtual machine escape whereby malware running inside a virtual machine reprograms the camera to act as a USB Human Interface Device (HID) keyboard which executes code in the host operating system. We build two proofs-of-concept: (1) an OS X application, iSeeYou, which demonstrates capturing video with the LED disabled; and (2) a virtual machine escape that launches Terminal.app and runs shell commands. To defend against these and related threats, we build an OS X kernel extension, iSightDefender, which prohibits the modification of the iSight’s firmware from user space.
Source : The Register
|
 |
| Vendor security patches lag dangerously |
Subscribers to organizations that sell exploits for vulnerabilities not yet known to software developers gain daily access to scores of flaws in the world’s most popular technology, a study shows.
NSS Labs, which is in the business of testing security products for corporate subscribers, found that over the last three years, subscribers of two major vulnerability programs had access on any given day to at least 58 exploitable flaws in Microsoft, Apple, Oracle, or Adobe products.
In addition, NSS labs found that an average of 151 days passed from the time when the programs purchased a vulnerability from a researcher and the affected vendor released a patch.
Some vendors buy in
The findings, released earlier this month, were based on an analysis of ten years of data from TippingPoint, a network security maker Hewlett-Packard acquired in 2010, and iDefense, a security intelligence service owned by VeriSign. Both organizations buy vulnerabilities, inform subscribers, and work with vendors in producing patches.
Stefan Frei, NSS research director and author of the report, said the actual number of secret vulnerabilities available to cybercriminals, government agencies and corporations is much larger, because of the amount of money they are willing to pay.
Cybercriminals will buy so-called zero-day vulnerabilities in the black market, while government agencies and corporations purchase them from brokers and exploit clearinghouses, such as VUPEN Security, ReVuln, Endgame Systems, Exodus Intelligence, and Netragard.
The six vendors collectively can provide at least 100 exploits per year to subscribers, Frei said. According to a February 2010 price list, Endgame sold 25 zero-day exploits a year for $2.5 million.
In July, Netragard founder Adriel Desautels told The New York Times that the average vulnerability sells from around $35,000 to $160,000.
Security: A moving target
Part of the reason vulnerabilities are always present is because of developer errors and also because software makers are in the business of selling product, experts say. The latter means meeting deadlines for shipping software often trumps spending additional time and money on security.
Because of the number of vulnerabilities bought and sold, companies that believe their intellectual property makes them prime targets for well-financed hackers should assume their computer systems have already been breached, Frei said.
”One hundred percent prevention is not possible,” he said.
Therefore, companies need to have the experts and security tools in place to detect compromises, Frei said. Once a breach is discovered, then there should be a well-defined plan in place for dealing with it.
That plan should include gathering forensic evidence to determine how the breach occurred. In addition, all software on the infected systems should be removed and reinstalled. Steps taken following a breach should be reviewed regularly to make sure they are up to date.
Via: PCWorld
Documents filed to the Federal Court of Canada describe Google as controlling at least one market related to search and advertising, potentially raising anti-trust concerns. The documents also suggest Google may have engaged in a number of anti-competitive acts by manipulating search results to favor their own products, or preventing data export from the company's AdWords platform. If the acts are found to be anti-competitive, it would mean a violation of Canadian anti-trust laws, and potentially grave consequences for the search giant.
This isn't the first time Google has faced regulatory scrutiny over its ad and search practices. In January of 2013, the company reached a settlement over similar claims by the US's Federal Trade Commission, which resulted in minor shifts in company practices. Those shifts were enough to halt ongoing suits in the international trade commission, although competitors like Yelp called the settlement "a missed opportunity." Judging by today's news, it seems as if Canada may not be satisfied either.
Source : Financial Post
Via : The Verge
 |
| Pawel Kopczynski / Reuters |
The latest documents from the National Security Agency leaked by Edward Snowden show that government spies are capable of listening in on mobile phone calls that use a common form of encryption, according to a Washington Post report. But if you're vulnerable, blame your carrier — this code has been cracked for years.
The Post on Friday published confidential government documents provided by Snowden that show that the NSA can "process" cellular phone calls on GSM networks, even if they are encrypted. GSM, which stands for Global System for Mobile communications, is the world's most widely used cellphone technology — though several large networks, notably Verizon and Sprint, rely on an older network technology called CDMA.
The report may sound scary, but there's a bit of explanation required that puts this in perspective.
First, it's only calls and not data that can be eavesdropped on, in this way at least. Second, it's only calls that have been encrypted according to a common standard called A5/1 — which was developed in 1987. The vulnerability comes into play on 2G networks, which modern cellphones may resort to it when 3G or 4G networks are not available or too congested.
It's not uncommon for old cryptography methods to be in use for decades, or become relevant after years of disuse. But A5/1 has remained in use despite several serious vulnerabilities being demonstrated by cryptographers. The methods are too technical to get into here, but a modern PC would have little trouble performing the attacks; a number of papers on the subject are stored atCryptome.
Why are carriers and phone manufacturers around the world using such an out-of-date cypher? It's not clear, but some carriers are already making the change to the newer A5/3 method of encryption.
One other thing to consider is that these conversations, however strong their encryption, are automatically decoded upon reaching the carrier's internal network. So even if the NSA can't listen in between a target and the tower, they could bring a judge-signed order to the carrier and not have to decrypt anything at all.
Lastly, the NSA has repeatedly stated that it only snoops on conversations involving foreign citizens, as it has no legal basis by which to conduct such surveillance on Americans. But if they can crack A5/1, others can as well — for everyone from hackers to foreign intelligence services, the cat's been out of the bag for a long time.
Source : NBC News
 |
| Anonymous hackers |
The hacktivist collective claimed responsibility for engineering the December 2010 distributed-denial-of-service attack in retaliation for the online payment processing company's suspension of an account linked to WikiLeaks after the document-leaking organization released a large number of classified documents.
"Citing violations of the PayPal terms of service, and in response to WikiLeaks' release of the classified cables, PayPal suspended WikiLeaks' accounts such that WikiLeaks could no longer receive donations via PayPal," US Attorney Melinda Haag in San Francisco said Friday in a statement. "WikiLeaks' website declared that PayPal's action 'tried to economically strangle WikiLeaks.'"
Ten of the defendants pleaded guilty Thursday to one misdemeanor count of damaging a protected computer and one felony count of conspiracy, which they will be allowed to change to a misdemeanor at sentencing if they do not violate the terms of their plea agreement, according to the US attorney's statement. The remaining three pleaded guilty to one misdemeanor count each related to the attack, according to the statement.
Source : CNET
 |
| There have been concerns over surveillance programmes in the US |
Eight firms, Google, Apple, Facebook, Twitter, AOL, Microsoft, LinkedIn, and Yahoo, have formed an alliance called Reform Government Surveillance group.
The group has written a letter to the US President and Congress arguing that current surveillance practice "undermines the freedom" of people.
It comes after recent leaks detailed the extent of surveillance programmes.
"We understand that governments have a duty to protect their citizens. But this summer's revelations highlighted the urgent need to reform government surveillance practices worldwide," the group said in an open letter published on its website.
"The balance in many countries has tipped too far in favour of the state and away from the rights of the individual - rights that are enshrined in our Constitution.
"This undermines the freedoms we all cherish. It's time for a change," it added.
Limited surveillance
The move by the eight firms comes after whistle-blower Edward Snowden leaked information about surveillance carried out by the US government.
Mr Snowden, an ex-US intelligence contractor, leaked documents to the media highlighting the various methods used by agencies to gather information.
"Reports about government surveillance have shown there is a real need for greater disclosure and new limits on how governments collect information," said Mark Zuckerberg, chief executive of Facebook, the world's biggest social networking firm.
"The US government should take this opportunity to lead this reform effort and make things right."
Source : BBC News
 |
| NSA spying |
If true, NSA spying could "seriously undermine confidence in the security and privacy of online communications," Microsoft's general counsel, Brad Smith, said in a blog post. "In light of these allegations, we've decided to take immediate and coordinated action."
Smith pledged to "pursue a comprehensive engineering effort to strengthen the encryption of customer data across our networks and services." That includes major communications, productivity, and developer services such as Outlook.com, Office 365, SkyDrive, and Windows Azure.
Content moving between customers and Microsoft's servers will be encrypted by default, as will communications moving between Redmond's data centers, using "best-in-class industry cryptography to protect these channels, including Perfect Forward Secrecy and 2048-bit key lengths," Smith said. "All of this will be in place by the end of 2014, and much of it is effective immediately."
Smith said Office 365 and Outlook.com customer content is already encrypted when traveling between customers and Microsoft, while most Office 365 workloads as well as Windows Azure storage are now encrypted in transit between data centers.
In addition to encryption, Microsoft also said it will "take new steps to reinforce legal protections for our customers' data," - like informing them when the feds request data. "Where a gag order attempts to prohibit us from doing this, we will challenge it in court," Smith said.
The company will also open a "network of transparency centers" in Europe, the Americas and Asia that will build on "our long-standing program that provides government customers with an appropriate ability to review our source code, reassure themselves of its integrity, and confirm there are no back doors."
"Ultimately, we're sensitive to the balances that must be struck when it comes to technology, security and the law, ... but we also want to live in a country that is protected by the Constitution," Smith concluded. "We believe these new steps strike the right balance, advancing for all of us both the security we need and the privacy we deserve."
Reports that Microsoft would step up encryption emerged last month. That came after The Washington Post, citing documents provided by Edward Snowden, reported on MUSCULAR, an NSA program that operates in conjunction with the U.K. version of the NSA, the Government Communications Headquarters (GCHQ). Together, they "are copying entire data flows across fiber-optic cables that carry information between the data centers of the Silicon Valley giants" like Yahoo and Google, the paper said.
Source : PCMag
While Microsoft's recent move to encrypt user data made the most headlines, the reasoning underlying its new data protection strategies classify the US government in the same category as a cyber-criminal group.
The term advanced persistent threat (APT) refers to an attacker, usually an organized group of malicious attackers, that should be considered harmful and dangerous — and an overall method of attack that plays a "long game."Brad Smith, Microsoft's EVP of Legal and Corporate Affairs, labeled the American government as an "advanced persistent threat" in a December 4 post on The Official Microsoft Blog.
Microsoft's explosive post begins by stating, "Many of our customers have serious concerns about government surveillance of the Internet."
(...) Like many others, we are especially alarmed by recent allegations in the press of a broader and concerted effort by some governments to circumvent online security measures – and in our view, legal processes and protections – in order to surreptitiously collect private customer data.Source : ZDNet
In particular, recent press stories have reported allegations of governmental interception and collection – without search warrants or legal subpoenas – of customer data as it travels between customers and servers or between company data centers in our industry.
If true, these efforts threaten to seriously undermine confidence in the security and privacy of online communications. Indeed, government snooping potentially now constitutes an “advanced persistent threat,” alongside sophisticated malware and cyber attacks.
 |
| NSA 'tracking' mobile phones |
Almost five billion mobile phone location records are logged by the NSA every day, reports the Washington Post.
The data is said to help the NSA track individuals, and map who they know, to aid the agency's anti-terror work.The "dragnet surveillance" was condemned by digital rights groups who called for the NSA's snooping efforts to be reined in.
The news comes as Microsoft plans to use more encryption to thwart NSA spying on it and its customers.
Wrong target The huge database built up by the NSA (National Security Agency) keeps an eye on "hundreds of millions" of mobile phones, said the Post, adding that it let the agency map movements and relationships in ways that were "previously unimaginable".
It added that the vast programme potentially surpassed any other NSA project in terms of its impact on privacy. Information about the programme was in papers released to the Post by whistleblower Edward Snowden.
The spying agency is said to have accumulated so much data, about 27 terabytes according to leaked papers seen by the Post, that it was "outpacing" the NSA's ability to analyse the information in a timely fashion.
The analysis, via a computer system called Co-Traveler, was necessary as only a tiny fraction of 1% of the data gathered was actually useful in its anti-terror work, said the paper. The analysis is so detailed that it can be used to thwart attempts to hide from scrutiny by people who use disposable phones or only use a handset briefly before switching it off.
The vast majority of the information gathered is said to come from taps installed on mobile phone networks and used the basic location-information that networks log as people move around. Analysing this data helps the NSA work out which devices are regularly in close proximity and, by implication, exposes a potential connection between the owners of those handsets.
The American Civil Liberties Union said it was "staggering" that the NSA could mount such a vast location-logging system without any public debate. The "dragnet surveillance" broke US obligations that require it to respect the privacy of foreigners and Americans.
"The government should be targeting its surveillance at those suspected of wrong-doing, not assembling massive associational databases that, by their very nature, record the movements of a huge number of innocent people," it added.
The steady flow of information about the NSA's surveillance work has led Microsoft to take steps to protect itself and its customers from unwarranted scrutiny, it said in a blogpost.
Source : BBC News
 |
| U.S. military : $50 million for massive software piracy |
Typically when you read about the U.S. government and piracy, it’s about some unfortunate file sharer who’s being slapped with a massive fine for uploading a few songs or TV shows. This time, however, the government itself was caught red-handed pirating.
Almost a decade ago, the Bush administration signed a contract with Apptricity — a company that develops warehouse, fleet, and asset management software. The original licensing agreement was for five servers and 150 additional devices. The deal would have netted Apptricity around $2.1 million. A decent score, but a mere fraction of what they actually should have been paid.
If the government was subjected to the same stiff fines, they’d be on the hook for around $33 trillion. Apptricity “generously” only went after what they were actually owed: a still-staggering $224 million in additional licensing fees.
Source : Geek.com
It used to be that palm reading was a practice confined to carnivals and fun fairs and one that was focused on spurious future predictions regarding unknown dark-haired persons of above-average height.
But now Fujitsu is using palm-reading technology to make sure that whether not they meet a tall dark stranger consumers' futures will feature better online security.
Joking aside, Fujitsu is a world leader in palm vein authentication technology, a type of biometric reading that analyzes the vein pattern of the palm, back of the hand and fingers. Each person's vein pattern is unique and the patterns themselves are invisible to the naked eye.
The Celsius H730 is the first notebook ever built which integrates the technology, and it means that instead of having to type in a password, the owner need only hover his or her hands over the device for the vein pattern to be scanned and recognized.
But as well as offering security measures that are currently only employed by the military and by investment banks, the notebook also packs a Haswell chip for faster yet more energy-efficient performance, a 15-inch display, and space for a rather impressive 32GB RAM on the top specification model.
Owners can also specify a solid state or hybrid hard drive too. Other impressive features include a spill-resistant keyboard -- something that should be standard on all new notebooks -- and something called ShockSensor which knows when the device is falling and braces its hard disk for impact.
The notebook will go on sale in Japan, India, Africa, the Middle East and Europe just in time for Christmas and although pricing will vary from region to region and based on internal specifications, Fujitsu has confirmed a guide price of 333,800 JPY in Japan and of €1,599 in Europe for the entry-level model.
Via: Yahoo News
Bogdan Alecu, a system administrator at Dutch IT services company Levi9, discovered that by bombarding a Nexus device with numerous Flash SMS in succession without dismissal the device will eventually reboot. While this isn’t a serious vulnerability it is still concerning since anyone can reboot a Nexus device without the owner of the device knowing it since they won’t know about the message unless they look at their phone.
Alecu said that if the smartphone receives around 30 flash messages that are not dismissed it begins to act erratically. The most common behavior is that the device will reboot itself. If a PIN has been setup then the owner will not know that their device is not connected to the network if they don’t look at it. During this period no messages, calls, or any notifications will be received by the device.
On rare occasions the Nexus will not reboot but will temporarily lose network connectivity. As soon as connectivity is restored the device will be able to make and receive calls however accessing the Internet over the mobile network will no longer work. To resolve this problem the device has to be rebooted.
This vulnerability was presented by Alecu Friday at the DefCamp security conference in Bucharest, Romania. A live test using a Nexus 4 running on Android 4.3 and its screen unlocked showed that when 30 flash messages were received and not dismissed did not result in a reboot. The device however became unresponsive and any attempts to lock the screen did not work. The device was eventually rebooted to make it operate normally again.
A second attempt to recreate the issue also failed to immediately reboot the device because only 2 of the 20 flash messages sent arrived on the device. After all 20 messages arrived, the device rebooted when the screen was unlocked.
Alecu said that he discovered this vulnerability a year ago and has confirmed that it is present in the Google Galaxy Nexus, Nexus 4 and Nexus 5 phones running various Android 4.x versions including the latest KitKat. He tried contacting Google regarding this vulnerability however only got an automated response. A member of the Android Security Team responded last July stating that the problem will be fixed with the release of Android 4.3 however apparently it still hasn’t.
Via : PCWorld
Read more at http://thedroidguy.com/2013/11/google-nexus-smartphones-vulnerable-rebooting-via-sms-attack/#18wOUZbHxClw31MS.99
Read more at http://thedroidguy.com/2013/11/google-nexus-smartphones-vulnerable-rebooting-via-sms-attack/#18wOUZbHxClw31MS.99
The companies are adopting harder-to-crack code to protect their networks and data, after years of largely rebuffing calls from the White House and privacy advocates to improve security. The new measures come after documents from Snowden revealed how US spy programmes gain access to the companies’ customer data—sometimes with their knowledge, sometimes without—and that’s threatening profits at home and abroad.
“These companies actively fought against numerous mechanisms that would have mandated far more secure data,” Sascha Meinrath, director of the Open Technology Institute at the New America Foundation in Washington, said in a phone interview. “Now they are paying the literal price.”
While Google, Yahoo, Microsoft and Facebook Inc. provide data to the government under court orders, they are trying to prevent NSA from gaining unauthorized access to information flowing between computer servers by using encryption. That scrambles data using a mathematical formula that can be decoded only with a special digital key.
The NSA has tapped fibre-optic cables abroad to siphon data from Google and Yahoo, circumvented or cracked encryption, and covertly introduced weaknesses and back doors into coding, according to reports in The Washington Post, The New York Times and the UK’s Guardian newspaper based on Snowden documents. He is now in Russia under temporary asylum.
‘Government snooping’
Microsoft is the latest company considering measures to ensure the protection of customer data and strengthen security against snooping by governments, according to Brad Smith, general counsel for the Redmond, Washington-based company.
Microsoft’s networks and services were allegedly hacked by NSA, The Washington Post reported on 26 November. Documents disclosed by Snowden suggest, without proving, that NSA targeted Microsoft’s Hotmail and Windows Live Messenger services under a programme called MUSCULAR, the newspaper said.
“These allegations are very disturbing,” Smith said in an e-mailed statement. “If they are true these actions amount to hacking and seizure of private data and in our view are a breach of the protection guaranteed by the Fourth Amendment to the Constitution.”
Smith didn’t provide details about what the company is considering doing.
Source : Livemint
Subscribe to:
Posts (Atom)
Recent Comments