Tag: digest

A world of hurt after McAfee mistakenly revokes key for signing Mac apps

Travis Nep Smith A McAfee administrator accidentally revoked the digital key used to certify desktop applications that run on Apple’s OS X platform, creating headaches for customers who want to install or upgrade Mac antivirus products. A certificate revocation list  [CRL] hosted by Apple Worldwide developer servers lists the reason for the cancellation as a “key compromise,” but McAfee officials said they never lost control of the sensitive certificate which is used to prove applications are legitimate releases. The revocation date shows as February 6, meaning that for seven days now, customers have had no means to validate McAfee applications they want to install on Macs. “We were told that as a workaround, we should just allow untrusted certificates until they figure it out,” an IT administrator at a large organization, who asked that he not be identified, told Ars. “They’re telling us to trust untrusted certs, and that definitely puts us at risk.” Read 6 remaining paragraphs | Comments

View the original here:
A world of hurt after McAfee mistakenly revokes key for signing Mac apps

How we built a DIY book scanner with speeds of 150 pages per minute

Bookshelves today are simply not as appealing as they used to be, and there’s no shortage of people looking to digitize their own book collections. Fortunately, we now have easy and relatively inexpensive ways to digitize those books. You don’t have to slave away at your copier or scanner, either—we’re talking about building a book scanner of your very own. We’re not talking about the numerous book scanning services that have popped up in the last few years, offering book digitization at the cost of only a few cents per page. Nor are we talking about chopping off the binding of your book and feeding the pages into a copier or scanner, or purchasing a commercial book scanner for upwards of $10,000 (that just isn’t going to happen for most). No, we’re talking toolbelts, paint cans, bike brakes, and digital cameras—doing it yourself. For two law students interested in the legal and policy discussions surrounding copyright and technology, deciding to build a DIY Book Scanner was never just a project to digitize our own textbooks (however practical that might be). Instead, it gave us the opportunity to experience these issues first hand. Plus, we wanted to see what it would take to build one. Read 31 remaining paragraphs | Comments

Read More:
How we built a DIY book scanner with speeds of 150 pages per minute

Spanish police bust alleged “ransomware” ring that took in $1.34M annually

Spanish authorities announced Wednesday that they had arrested 10 people who were allegedly involved in a massive “ransomware” ring. The European Cybercrime Centre estimated that the criminal operation “affected tens of thousands of computers worldwide, bringing in profits in excess of €1 million euros ($1.34 million) per year.” The Spanish Ministry of the Interior described (Google Translate) the lead suspect as a “a 27-year-old citizen of Russian origin who was arrested in December in the United Arab Emirates,” and now awaits extradition to Spain. The newly arrested 10 were  linked to the financial cell of the ransomware operation, and include six Russians, two Ukrainians, and two Georgians. The Ministry added that the operation remains “open,” suggesting that more arrests could be forthcoming. (Spanish authorities posted a video (RAR) of the new arrests and raid.) Madrid dubbed  the ransomware used by the ring a “police virus” because it throws up a notice that appears to come from law enforcement. The malware requires the user to pay €100 ($134) as a “fine” from a false accusation of accessing child pornography or file-sharing websites. When the victims submit their payment details, European authorities added , the “criminals then go on to steal data and information from the victim’s computer.” Read 7 remaining paragraphs | Comments

Read the original:
Spanish police bust alleged “ransomware” ring that took in $1.34M annually

Zero-day attack exploits latest version of Adobe Reader

FireEye A previously undocumented flaw in the latest version of Adobe Systems’ ubiquitous Reader application is being exploited in online hacks that allow attackers to surreptitiously install malware on end-user computers, a security firm said. The attacks, according to researchers from security firm FireEye, work against Reader 11.0.1 and earlier versions and are actively being exploited in the wild. If true, the attacks are notable because they pierce security defenses Adobe engineers designed to make malware attacks harder to carry out. Adobe officials said they’re investigating the report . “Upon successful exploitation, it will drop two DLLs,” FireEye researchers Yichong Lin, Thoufique Haq, and James Bennett wrote of the online attacks they witnessed. “The first DLL shows a fake error message and opens a decoy PDF document, which is usually common in targeted attacks. The second DLL in turn drops the callback component, which talks to a remote domain.” DLL is the researchers’ shorthand for a file that works with the Microsoft Windows dynamic link library. Read 5 remaining paragraphs | Comments

Taken from:
Zero-day attack exploits latest version of Adobe Reader

Comcast acquires full ownership of NBCUniversal ahead of schedule

Comcast, the nation’s largest cable provider, will consolidate its control over NBCUniversal by buying out the 49 percent of the media company that it doesn’t already own. Comcast will pay General Electric $16.7 billion for the shares and shell out $1.4 billion for related real estate, including the iconic 30 Rockefeller Plaza. Under a deal announced in 2009, General Electric spun NBC, Universal Studios, and various other media properties off into a new joint venture and sold 51 percent of the shares, and effective control, to Comcast. The merger was intensely controversial. Critics charged that the acquisition would further cement Comcast’s already dominant position in the cable market, making it impossible for competitors such as Netflix to compete on a level playing field. But regulators decided not to challenge the merger, settling for a long list of regulatory concessions. Read 4 remaining paragraphs | Comments

View original post here:
Comcast acquires full ownership of NBCUniversal ahead of schedule

Obama administration defends $222,000 file-sharing verdict

Credit: U.S. Embassy, Jakarta The Obama Administration has stepped into a long-running file-sharing lawsuit in Minnesota, urging the United States Supreme Court not to get involved in a six-figure verdict against a young mother from Northern Minnesota. The feds don’t buy the woman’s argument that the massive size of the award makes it unconstitutional. Jammie Thomas-Rasset has been fighting a recording industry lawsuit accusing her of sharing music using the now-defunct peer-to-peer network Kazaa for the better part of a decade. In 2007, a jury found Thomas-Rasset liable to the tune of $222,000 for sharing 24 songs. She appealed the verdict, resulting in two more trials that each produced even larger jury awards. These higher figures were thrown out by the courts, but last year, the Eighth Circuit Court of Appeals upheld the $222,000 award. Thomas-Rasset is now seeking review by the Supreme Court. In a December brief , her lawyer drew an analogy to a line of Supreme Court decisions regarding excessive punitive damages. In those cases, juries had awarded punitive damages that were more than 100 times larger than the actual damages suffered by the plaintiffs. The Supreme Court held that such disproportionate punitive damages violate the due process clause of the Constitution. Read 6 remaining paragraphs | Comments

More:
Obama administration defends $222,000 file-sharing verdict

At Facebook, zero-day exploits, backdoor code bring war games drill to life

Aurich Lawson Early on Halloween morning, members of Facebook’s Computer Emergency Response Team received an urgent e-mail from an FBI special agent who regularly briefs them on security matters. The e-mail contained a Facebook link to a PHP script that appeared to give anyone who knew its location unfettered access to the site’s front-end system. It also referenced a suspicious IP address that suggested criminal hackers in Beijing were involved. “Sorry for the early e-mail but I am at the airport about to fly home,” the e-mail started. It was 7:01am. “Based on what I know of the group it could be ugly. Not sure if you can see it anywhere or if it’s even yours.” The e-mail reporting a simulated hack into Facebook’s network. It touched off a major drill designed to test the company’s ability to respond to security crises. Facebook Facebook employees immediately dug into the mysterious code. What they found only heightened suspicions that something was terribly wrong. Facebook procedures require all code posted to the site to be handled by two members of its development team, and yet this script somehow evaded those measures. At 10:45am, the incident received a classification known as “unbreak now,” the Facebook equivalent of the US military’s emergency DEFCON 1 rating. At 11:04am, after identifying the account used to publish the code, the team learned the engineer the account belonged to knew nothing about the script. One minute later, they issued a takedown to remove the code from their servers. Read 31 remaining paragraphs | Comments

Link:
At Facebook, zero-day exploits, backdoor code bring war games drill to life

Cause of Super Bowl blackout was installed to prevent Super Bowl blackout

Entergy New Orleans, the utility that provides power to the Mercedes SuperDome in New Orleans, announced today that its technicians had determined the cause of the partial blackout during the Super Bowl last Sunday: an electrical relay the company had installed to prevent blackouts. The relay was supposed to trip switches to redirect power in the event of a line fault over one of the cables connecting Entergy’s switching gear to the stadium. In a statement , the company said that “the relay functioned without issue during a number of high-profile events—including the New Orleans Bowl, the New Orleans Saints-Carolina Panthers game, and the Sugar Bowl.” But on Super Bowl Sunday, the device instead triggered when there was no fault, signaling a switch to open shortly after the second half began. The relay has now been pulled, and Entergy is evaluating other equipment. “While some further analysis remains,” said Entergy New Orleans President and CEO Charles Rice in the prepared statement, “we believe we have identified and remedied the cause of the power outage and regret the interruption that occurred during what was a showcase event for the city and state.” Read 1 remaining paragraphs | Comments

See the original article here:
Cause of Super Bowl blackout was installed to prevent Super Bowl blackout

At long last, TI releases graphing calculator for the iPad

A TI-Nspire’s functionality, replicated on an iPad. TI/TechPoweredMath Texas Instruments has brought its graphing calculator functionality to a more modern platform, according to TechPoweredMath . TI-Nspire for iPad mimics the functionality of the color TI-Nspire calculator and has cloud integration for teachers to share files with students. TI’s graphing calculators have been stuck staunchly in the past as much as possible.  Color screens were  a recent development for its most popular line of devices, and developers have had to build games with only a handful of kilobytes of code . As smartphones and tablets rise in popularity, it makes increasing sense to fold the graphing calculator functionality into devices that students are likely carrying around with them anyway. This is not to say graphing calculator apps haven’t existed for some time—they have, for both smartphones and tablets, and many are free. But until now, TI has refused to cross over. Read 3 remaining paragraphs | Comments

Read this article:
At long last, TI releases graphing calculator for the iPad

We’re going to blow up your boiler: Critical bug threatens hospital systems

A picture of a Tridium device running the Niagara AX framework. Tridium More than 21,000 Internet-connected devices sold by Honeywell are vulnerable to a hack that allows attackers to remotely seize control of building heating systems, elevators, and other industrial equipment and in some cases, causes them to malfunction. The hijacking vulnerability in Niagara AX-branded hardware and software sold by Honeywell’s Tridium division was demonstrated at this week’s Kaspersky Security Analyst Summit in San Juan, Puerto Rico. Billy Rios and Terry McCorkle, two security experts with a firm called Cylance , allowed an audience to watch as they executed a custom script that took about 25 seconds to take control of a default configuration of the industrial control software. When they were done they had unfettered control over the device, which is used to centralize control over alarm systems, garage doors, heating ventilation and cooling systems, and other equipment in large buildings. Taking advantage of the flaw would give attackers half a world away the same control on-site engineers have over connected systems. Extortionists, disgruntled or unstable employees, or even terrorists could potentially exploit vulnerabilities that allow them to bring about catastrophic effects, such as causing a large heating system to explode or catch fire or sabotaging large chillers used by hospitals and other facilities. Attackers could also exploit the bug to gain a toehold into networks, which could then be further penetrated using additional vulnerabilities that may be present. Read 12 remaining paragraphs | Comments

View the original here:
We’re going to blow up your boiler: Critical bug threatens hospital systems