Tag: digest-golf

Four weeks on, huge swaths of the Internet remain vulnerable to Heartbleed

Aurich Lawson / Thinkstock More than four weeks after the disclosure of the so-called Heartbleed bug found in a widely used cryptography package , slightly more or slightly less than half the systems affected by the catastrophic flaw remain vulnerable, according to two recently released estimates. A scan performed last month by Errata Security CEO Rob Graham found 615,268 servers that indicated they were vulnerable to attacks that could steal passwords, other types of login credentials, and even the extremely sensitive private encryption keys that allow attackers to impersonate websites or monitor encrypted traffic. On Thursday, the number stood at 318,239. Graham said his scans counted only servers running vulnerable versions of the OpenSSL crypto library that enabled the “Heartbeat” feature where the critical flaw resides. A separate scan using slightly different metrics arrived at an estimate that slightly less than half of the servers believed to be vulnerable in the days immediately following the Heartbleed disclosure remain susceptible. Using a tool the researcher yngve called TLS Prober, he found that 5.36 percent of all servers were vulnerable to Heartbleed as of April 11, four days after Heartbleed came to light. In a blog post published Wednesday , he said 2.33 percent of servers remained vulnerable. It’s important to remember the results don’t include the number of Heartbleed-vulnerable servers providing services such a virtual private networks or e-mail. Read 3 remaining paragraphs | Comments

More:
Four weeks on, huge swaths of the Internet remain vulnerable to Heartbleed

Epic announces crowdsourced dev model for next Unreal Tournament

It’s been a long six-and-a-half years since we’ve gotten a new Unreal Tournament game (not counting expansion packs), but today marks the beginning of the end for that wait. Epic announced  that work on a new game, simply titled Unreal Tournament , begins today for PC, Mac, and Linux, and the process will heavily involve participation from the modding and player community from the get go. While a “small team of UT veterans” at Epic will be spearheading the development of the game, everything from design decisions to art direction will primarily “happen in the open, as a collaboration between Epic, UT fans, and [Unreal Engine 4] developers,” Epic says. The developers are inviting everyone from regular players to experienced modders from sites like Polycount to sign up at the Unreal Engine forums and use an official wiki to take direct part in driving the game’s direction. Already, mere minutes after the announcement, those forums are filled with players discussing everything from series maps and weapons they’d like to see return to things like VR headset compatibility. Epic says it will be “many months” until the game is in any sort of playable state, but when it is playable it “will be free. Not free to play, just free.” Source code will be made available directly from GitHub as it is updated, and modders will even be able to fork their own builds if they want to take the project in a new direction. Read 2 remaining paragraphs | Comments

Follow this link:
Epic announces crowdsourced dev model for next Unreal Tournament

New guidelines outline what iPhone data Apple can give to police

If you store your stuff on iCloud, Apple can provide most of that information to law enforcement if it’s requested. Andrew Cunningham We’ve known (or suspected) for some time that Apple can provide data from iOS devices to US law enforcement, whether that data is stored on Apple’s iCloud servers or on a password protected phone or tablet . In an effort to be more transparent about this process, Apple yesterday posted an extensive document describing what data the company can provide to law enforcement and the processes for requesting that data. The document outlines two basic types of data: information stored on Apple’s servers and information stored locally on iOS devices. Information on Apple’s servers includes both data associated with your Apple ID—your basic contact information, customer service records, your transaction history both in Apple’s retail stores and in the online iTunes and App Stores, and iTunes gift card information—and data associated with your iCloud account. All account data stored on Apple’s servers is obtainable “with a subpoena or greater legal process.” The short version is that essentially anything you’ve backed up to or stored on iCloud is available for Apple to fork over to law enforcement, including connection logs and IP addresses you’ve used. Apple has access to 60 days of iCloud mail logs that “include records of incoming and outgoing communications such as time, date, sender e-mail addresses, and recipient e-mail addresses”; any e-mail messages that the user has not deleted; and any other information that can be backed up to iCloud. As of this writing, this list includes contacts, calendars, browser bookmarks, Photo Stream photos, anything that uses the “documents and data” feature (which can include not just word processors but also photo and video apps, games, and data from other applications), and full device backups. Subscriber information requires a “subpoena or greater legal process,” e-mail logs require a court order or search warrant, and e-mail or other iCloud content requires a search warrant. Any iCloud information that the user deletes cannot be accessed. Read 5 remaining paragraphs | Comments

See more here:
New guidelines outline what iPhone data Apple can give to police

Intel and Google boast 11-hour battery life with upcoming Chromebooks

Intel Intel Intel likes Chrome OS. Need proof? The company is apparently the number-two contributor to the operating system’s code after Google itself. Intel and Google also co-hosted a small event in San Francisco today, intended to highlight Intel’s commitment to Chrome OS and the number of PC OEMs that are shipping Intel-equipped Chromebooks. Many of Intel and Google’s announcements were about products we already knew about: there’s a multi-colored HP Chromebox coming in June for an as-yet-undisclosed price, and LG’s Chromebase all-in-one will be here later this month for $349. Both Acer and Dell are also tweaking their existing 11-inch Chromebooks, providing a faster Core i3 CPU option to complement the lower-end Celeron offerings. The Acer version will cost $349 when it launches later in the summer, while the Dell model will ship later in the year. Intel and Google started by telling us more about Chrome devices we’ve already met. Intel The truly new Chromebooks announced at the presentation used Intel’s Bay Trail platform rather than the more common Haswell chips. These gadgets share a number of characteristics: like the ARM Chromebooks we’ve seen so far, they’re fanless. Intel says they’ll run for “up to” 11 hours, compared to around 10 hours for Haswell designs, and they’ll include Intel’s 802.11ac Wi-Fi adapters instead of the single- and dual-band 802.11n adapters most current Chromebooks use. Bay Trail Chromebooks are going to give up a significant amount of CPU and GPU performance compared to even the slowest Haswell chips, but the other benefits may outweigh that hit. Bay Trail comes to Chromebooks. Intel Asus, Acer, Toshiba, and Lenovo will be the first PC OEMs to ship Bay Trail-based Chromebooks, not counting a basic education-focused reference design that Intel showed off during the presentation. Asus is offering both 11-inch (C200) and 13-inch (C300) Bay Trail Chromebooks with dual-core Bay Trail Celeron chips (the N2830 , to be exact), 2GB of RAM, 16GB of solid-state storage, 1366×768 displays, and 802.11ac. The 11-inch model weighs 2.5 pounds, while the 13-inch model is 3.1 pounds, and the lineup will reportedly start at $250 . The Toshiba and Acer models weren’t shown, and we don’t yet know anything about specific specifications, pricing, or availability for either of them. Lenovo’s Chromebooks are a little more intriguing . The company is offering two models, the N20 and the N20p. Both use 11.6-inch 1366×768 displays, quad-core Bay Trail Celeron chips, 2GB or 4GB of RAM, 16GB of solid-state storage, and about eight hours of battery life. The difference between the two is that the N20p integrates a Yoga-like flexible hinge and a touchscreen that can be flipped backward (though it won’t sit flush against the bottom of the laptop like the regular Yogas will). The standard N20 will start at $279 when it’s available in July, and the N20p will start at $329 in August. The event also played up Chrome OS’ momentum in the marketplace, though no one who spoke used specific sales numbers. They chose instead to focus on other metrics—that seven of the top 20 best-selling laptops on Amazon are Chromebooks, that the Asus Chromebox  has been the best-selling desktop on Amazon since it was introduced, and that Amazon customer reviews on these devices are generally favorable. Eight major PC OEMs are now selling Chrome OS devices, and they’re available in 20 countries (with nine more countries to follow). Chromebooks were initially available from just two PC OEMs, but six more have since joined them. Intel The Q&A session with representatives from Acer, Lenovo, Dell, and Google yielded few substantive answers to the most interesting questions. Can we expect a Chrome OS tablet, as has occasionally been rumored ? Are any of the OEMs planning to build a machine more like the Chromebook Pixel and less like a netbook? What about Chromebooks with larger screens since most of the current crop includes 11.6-inch panels? The reps would only give some version of “we’re always evaluating new form factors” before moving on. Even if the computers highlighted and announced today aren’t mind-blowing individually, the breadth and variety of the Chrome OS ecosystem as a whole has become quite impressive in the last two years. There’s still a conspicuous gap between the Acer C720 and HP Chromebook 11 at the bottom of the laptop pile and the Chromebook Pixel at the top of it, but as of this summer Chrome OS will come in pretty much any form factor you could want. In 2011 all we had were a couple of lackluster netbooks that retailed for $499 . Now you can even grab touch-enabled laptops, mini desktops, and all-in-ones for well below that price. All we need to do is wait another couple of years to see whether this is the birth of a vibrant new post-PC ecosystem or a netbook-style gold rush. Read on Ars Technica | Comments

Read this article:
Intel and Google boast 11-hour battery life with upcoming Chromebooks

Level 3 claims six ISPs dropping packets every day over money disputes

Network operator Level 3, which has asked the FCC to protect it from ” arbitrary access charges ” that ISPs want in exchange for accepting Internet traffic, today claimed that six consumer broadband providers have allowed a state of “permanent congestion” by refusing to upgrade peering connections for the past year. Level 3 and Cogent, another network operator, have been involved in disputes with ISPs over whether they should pay for the right to send them traffic. ISPs have demanded payment in exchange for accepting streaming video and other data that is passed from the network providers to ISPs and eventually to consumers. When the interconnections aren’t upgraded, it can lead to congestion and dropped packets, as we wrote previously regarding a dispute between  Cogent and Verizon . In a blog post today , Level 3 VP Mark Taylor wrote: Read 4 remaining paragraphs | Comments

Read the article:
Level 3 claims six ISPs dropping packets every day over money disputes

High School senior charged with hacking report-card system

A high school senior in Miami has been arrested on charges claiming he illegally accessed his school’s online report card system and changed grades for him and at least four other students, according to a published report. Jose Bautista, 18, appeared in court Friday, according to WFOR . He reportedly faces charges of intellectual property offense, modifying programs, and an offense against computer users. The student allegedly approached fellow students and asked if they wanted him to change their grades. The principal of Dr. Michael M. Krop Senior High School, the school Bautista attended, said the student gave a written confession detailing the hacking. Bautista’s bond was set at $20,000. He is under house arrest with a GPS monitor. It’s unclear if he will be allowed to graduate or if the other students involved will face any punishment. Read on Ars Technica | Comments

Read this article:
High School senior charged with hacking report-card system

Hulu to launch free mobile content, new iOS app this summer

Free Hulu users will enjoy more full, ad-supported TV episodes this summer, and those ads will quite possibly force Pizza Hut pizza down their throats. Future app updates will add “extra cheese” as an option (we hope). This morning, Hulu CEO Mike Hopkins announced at a New York event that the streaming media service would begin offering select free content to mobile users “this summer.” Currently, Hulu requires a “Plus” subscription to watch its full-length TV and film content on anything other than a desktop Web browser, while non-paying app users are limited to brief video clips until they cough up $7.99 a month. Like Hulu’s free and paid content up until this point, the free-for-mobile summer content will remain advertising-backed. Though the free shows in question haven’t been announced, Hulu used the event to promote its next wave of internally produced programming, including new seasons of The Awesomes and Deadbeat , and it’s tempting to assume that the free mobile access will lean toward some of the only-on-Hulu selection. The move may very well have come in response to individual networks releasing more apps, particularly Comedy Central’s recent self-titled app that serves free, ad-supported episodes for all users (along with a deeper video selection after a user logs in with cable subscription information). Read 1 remaining paragraphs | Comments

More:
Hulu to launch free mobile content, new iOS app this summer

Zero-day Flash bug under active attack in Windows threatens OS X, Linux too

A fragment of the shellcode exploiting a critical vulnerability in Adobe Flash. Kaspersky Lab A day after reports that attackers are exploiting a zero-day vulnerability in Microsoft’s Internet Explorer browser , researchers warned of a separate active campaign that was targeting a critical vulnerability in fully patched versions of Adobe’s ubiquitous Flash media player. The attacks were hosted on the Syrian Ministry of Justice website at hxxp://jpic.gov.sy and were detected on seven computers located in Syria, leading to theories that the campaign targeted dissidents complaining about the government of President Bashar al-Assad, according to a blog post published Monday by researchers from antivirus provider Kaspersky Lab. The attacks exploited a previously unknown vulnerability in Flash when people used the Firefox browser to access a booby-trapped page. The attackers appear to be unrelated to those reported on Sunday who exploited a critical security bug in Internet Explorer, a Kaspersky representative told Ars. While the exploit Kaspersky observed attacked only computers running Microsoft Windows, the underlying flaw, which is formally categorized as CVE-2014-1776  and resides in a Flash component known as the Pixel Bender, is present in the Adobe application built for OS X and Linux machines as well. Adobe has updated all three versions to plug the hole. Because security holes frequently become much more widely exploited in the hours or days after they are disclosed, people on all three platforms should update as soon as possible . People using IE 10 and 11 on Windowws 8 will receive the update automatically, as will users of Google’s Chrome browser. It can sometimes take hours for the automatic updates to arrive. Those who are truly cautious should consider manually installing them. Read 4 remaining paragraphs | Comments

More here:
Zero-day Flash bug under active attack in Windows threatens OS X, Linux too

Netflix is paying Verizon for network connection to speed up video

Netflix today confirmed that it reached an interconnection agreement with Verizon, similar to the one it recently struck with Comcast. “We have reached an interconnect arrangement with Verizon that we hope will improve performance for our joint customers over the coming months,” Netflix spokesperson Joris Evers told Ars. “It is a paid interconnect agreement.”Word of the deal first leaked on Twitter when analyst Walter Piecyk wrote , “Verizon CEO [Lowell McAdam] confirms they have signed direct connection deal with Netflix like Comcast’s.” When contacted by Ars, Piecyk said that “McAdam confirmed a deal with Netflix in answer to our question at a group investor meeting [today]. No further details were provided on the financial terms.” Read 7 remaining paragraphs | Comments

See more here:
Netflix is paying Verizon for network connection to speed up video

Bank robbers use KVM switch and 3G router to steal money

The networked KVM switch and 3G router used to rob a Barclays Bank branch remotely. Metropolitan Police, London Nine members of a London-based gang have been convicted  and three others are scheduled for sentencing in June for a series of electronic bank robberies. Using social engineering to install a remote-controlled keyboard-video-mouse (KVM) switch on bank PCs, the gang managed to transfer millions to outside accounts in two separate jobs in April and July of 2013. They were caught attempting to rob a third bank in September. Dean Outram, 32, entered all three banks claiming to be from a tech support contractor and saying he was there to repair computers. At each bank branch robbed, Outram installed a KVM switch and a 3G wireless router . From a “control center” in central London, others then used the KVM switches to gain access to the PCs of bank employees, remotely logging keystrokes and monitoring screen activity to get the information necessary to transfer funds from customers’ accounts to accounts controlled by the group. In the first attempt, the group managed to make 128 fund transfers totaling £1.3 million (about $2 million) in one day from a branch of Barclays Bank. The bank detected the fraud the same day and recovered about £600,000 ($1 million) of the funds before the gang drained the accounts. In its second attempt at another Barclays branch, the group was able to make off with £90,000 (about $150,000). Read 3 remaining paragraphs | Comments

Visit link:
Bank robbers use KVM switch and 3G router to steal money