Tag: feeds

Four weeks on, huge swaths of the Internet remain vulnerable to Heartbleed

Aurich Lawson / Thinkstock More than four weeks after the disclosure of the so-called Heartbleed bug found in a widely used cryptography package , slightly more or slightly less than half the systems affected by the catastrophic flaw remain vulnerable, according to two recently released estimates. A scan performed last month by Errata Security CEO Rob Graham found 615,268 servers that indicated they were vulnerable to attacks that could steal passwords, other types of login credentials, and even the extremely sensitive private encryption keys that allow attackers to impersonate websites or monitor encrypted traffic. On Thursday, the number stood at 318,239. Graham said his scans counted only servers running vulnerable versions of the OpenSSL crypto library that enabled the “Heartbeat” feature where the critical flaw resides. A separate scan using slightly different metrics arrived at an estimate that slightly less than half of the servers believed to be vulnerable in the days immediately following the Heartbleed disclosure remain susceptible. Using a tool the researcher yngve called TLS Prober, he found that 5.36 percent of all servers were vulnerable to Heartbleed as of April 11, four days after Heartbleed came to light. In a blog post published Wednesday , he said 2.33 percent of servers remained vulnerable. It’s important to remember the results don’t include the number of Heartbleed-vulnerable servers providing services such a virtual private networks or e-mail. Read 3 remaining paragraphs | Comments

More:
Four weeks on, huge swaths of the Internet remain vulnerable to Heartbleed

Intel and Google boast 11-hour battery life with upcoming Chromebooks

Intel Intel Intel likes Chrome OS. Need proof? The company is apparently the number-two contributor to the operating system’s code after Google itself. Intel and Google also co-hosted a small event in San Francisco today, intended to highlight Intel’s commitment to Chrome OS and the number of PC OEMs that are shipping Intel-equipped Chromebooks. Many of Intel and Google’s announcements were about products we already knew about: there’s a multi-colored HP Chromebox coming in June for an as-yet-undisclosed price, and LG’s Chromebase all-in-one will be here later this month for $349. Both Acer and Dell are also tweaking their existing 11-inch Chromebooks, providing a faster Core i3 CPU option to complement the lower-end Celeron offerings. The Acer version will cost $349 when it launches later in the summer, while the Dell model will ship later in the year. Intel and Google started by telling us more about Chrome devices we’ve already met. Intel The truly new Chromebooks announced at the presentation used Intel’s Bay Trail platform rather than the more common Haswell chips. These gadgets share a number of characteristics: like the ARM Chromebooks we’ve seen so far, they’re fanless. Intel says they’ll run for “up to” 11 hours, compared to around 10 hours for Haswell designs, and they’ll include Intel’s 802.11ac Wi-Fi adapters instead of the single- and dual-band 802.11n adapters most current Chromebooks use. Bay Trail Chromebooks are going to give up a significant amount of CPU and GPU performance compared to even the slowest Haswell chips, but the other benefits may outweigh that hit. Bay Trail comes to Chromebooks. Intel Asus, Acer, Toshiba, and Lenovo will be the first PC OEMs to ship Bay Trail-based Chromebooks, not counting a basic education-focused reference design that Intel showed off during the presentation. Asus is offering both 11-inch (C200) and 13-inch (C300) Bay Trail Chromebooks with dual-core Bay Trail Celeron chips (the N2830 , to be exact), 2GB of RAM, 16GB of solid-state storage, 1366×768 displays, and 802.11ac. The 11-inch model weighs 2.5 pounds, while the 13-inch model is 3.1 pounds, and the lineup will reportedly start at $250 . The Toshiba and Acer models weren’t shown, and we don’t yet know anything about specific specifications, pricing, or availability for either of them. Lenovo’s Chromebooks are a little more intriguing . The company is offering two models, the N20 and the N20p. Both use 11.6-inch 1366×768 displays, quad-core Bay Trail Celeron chips, 2GB or 4GB of RAM, 16GB of solid-state storage, and about eight hours of battery life. The difference between the two is that the N20p integrates a Yoga-like flexible hinge and a touchscreen that can be flipped backward (though it won’t sit flush against the bottom of the laptop like the regular Yogas will). The standard N20 will start at $279 when it’s available in July, and the N20p will start at $329 in August. The event also played up Chrome OS’ momentum in the marketplace, though no one who spoke used specific sales numbers. They chose instead to focus on other metrics—that seven of the top 20 best-selling laptops on Amazon are Chromebooks, that the Asus Chromebox  has been the best-selling desktop on Amazon since it was introduced, and that Amazon customer reviews on these devices are generally favorable. Eight major PC OEMs are now selling Chrome OS devices, and they’re available in 20 countries (with nine more countries to follow). Chromebooks were initially available from just two PC OEMs, but six more have since joined them. Intel The Q&A session with representatives from Acer, Lenovo, Dell, and Google yielded few substantive answers to the most interesting questions. Can we expect a Chrome OS tablet, as has occasionally been rumored ? Are any of the OEMs planning to build a machine more like the Chromebook Pixel and less like a netbook? What about Chromebooks with larger screens since most of the current crop includes 11.6-inch panels? The reps would only give some version of “we’re always evaluating new form factors” before moving on. Even if the computers highlighted and announced today aren’t mind-blowing individually, the breadth and variety of the Chrome OS ecosystem as a whole has become quite impressive in the last two years. There’s still a conspicuous gap between the Acer C720 and HP Chromebook 11 at the bottom of the laptop pile and the Chromebook Pixel at the top of it, but as of this summer Chrome OS will come in pretty much any form factor you could want. In 2011 all we had were a couple of lackluster netbooks that retailed for $499 . Now you can even grab touch-enabled laptops, mini desktops, and all-in-ones for well below that price. All we need to do is wait another couple of years to see whether this is the birth of a vibrant new post-PC ecosystem or a netbook-style gold rush. Read on Ars Technica | Comments

Read this article:
Intel and Google boast 11-hour battery life with upcoming Chromebooks

ARM: The $20 smartphone will be possible “in the next few months”

Basic smartphones are cheap—and getting cheaper. ARM Smartphone prices have been creeping ever downward in the last few years, and ARM is betting that they’re going to go even lower. AnandTech is reporting from ARM’s Tech Day today , and one of the company’s slides predicts that the cost of a phone with a single-core Cortex A5 chip in it will go as low as $20 within the next few months. Of course, these ultra-low-cost phones won’t be devices tech enthusiasts lust after. ARM notes that even a $25 phone like the Firefox handsets announced at Mobile World Congress  have to cut down on RAM and other specs to hit that price point, and it’s unlikely that something with such low specs could run something like Android satisfactorily. More expensive phones like the $179 Moto G will still be necessary if you want that full smartphone experience on a budget. Still, for those ever-important emerging markets where the smartphone has yet to take off, any OEM that can provide a decent experience for this price is going to fill an important niche. In other news from ARM’s Tech Day, ARM shared some new performance estimates for its upcoming 64-bit Cortex A53 and A57 architectures. The company predicts that chips based on these architectures will be about 1.5 times as fast as the Cortex A7 and A15 architectures they replace when the SoCs are all built on the same 28nm manufacturing process. When moved to a newer 20nm or 16nm manufacturing process, though, the A57 in particular will supposedly be nearly twice as fast as the older A15. Read 1 remaining paragraphs | Comments

View article:
ARM: The $20 smartphone will be possible “in the next few months”

Level 3 claims six ISPs dropping packets every day over money disputes

Network operator Level 3, which has asked the FCC to protect it from ” arbitrary access charges ” that ISPs want in exchange for accepting Internet traffic, today claimed that six consumer broadband providers have allowed a state of “permanent congestion” by refusing to upgrade peering connections for the past year. Level 3 and Cogent, another network operator, have been involved in disputes with ISPs over whether they should pay for the right to send them traffic. ISPs have demanded payment in exchange for accepting streaming video and other data that is passed from the network providers to ISPs and eventually to consumers. When the interconnections aren’t upgraded, it can lead to congestion and dropped packets, as we wrote previously regarding a dispute between  Cogent and Verizon . In a blog post today , Level 3 VP Mark Taylor wrote: Read 4 remaining paragraphs | Comments

Read the article:
Level 3 claims six ISPs dropping packets every day over money disputes

Infecting DVRs with Bitcoin-mining malware even easier than you suspected

The dialog that appears when users want to manually change the default password on their EPCOM Hikvision S04 DVR. Sans Institute It took just one day for a low-end, Internet-connected digital video recorder to become infected with malware that surreptitiously mined Bitcoins on behalf of the quick-moving attackers. The feat, documented in a blog post published Monday by researchers at the security-training outfit Sans Institute, was all the more impressive because the DVR contained no interface for downloading software from the Internet. The lack of a Wget , ftp, or kermit application posed little challenge for the attackers. To work around the limitation, the miscreants used a series of Unix commands that effectively uploaded and executed a Wget package and then used it to retrieve the Bitcoin miner from an Internet-connected server. Monday’s observations from Sans CTO Johannes Ullrich are part of an ongoing series showing the increasing vulnerability of Internet-connected appliances to malware attacks. In this case, he bought an EPCOM Hikvision S04 DVR off eBay, put it into what he believes was its factory new condition, and connected it to a laboratory “honeypot” where it was susceptible to online attackers. In the first day, it was probed by 13 different IP addresses, six of which were able to log into it using the default username and password combination of “root” and “12345.” Read 4 remaining paragraphs | Comments

View article:
Infecting DVRs with Bitcoin-mining malware even easier than you suspected

High School senior charged with hacking report-card system

A high school senior in Miami has been arrested on charges claiming he illegally accessed his school’s online report card system and changed grades for him and at least four other students, according to a published report. Jose Bautista, 18, appeared in court Friday, according to WFOR . He reportedly faces charges of intellectual property offense, modifying programs, and an offense against computer users. The student allegedly approached fellow students and asked if they wanted him to change their grades. The principal of Dr. Michael M. Krop Senior High School, the school Bautista attended, said the student gave a written confession detailing the hacking. Bautista’s bond was set at $20,000. He is under house arrest with a GPS monitor. It’s unclear if he will be allowed to graduate or if the other students involved will face any punishment. Read on Ars Technica | Comments

Read this article:
High School senior charged with hacking report-card system

Maryland police to live-tweet prostitution sting

Elvert Barnes/Flickr Maryland’s Prince George’s Police Department (PGPD), which covers part of the Washington, DC metropolitan area, announced on various social media platforms that it will be live-tweeting a prostitution sting operation “sometime next week.” What could possibly go wrong? Despite a headline that reads as if it were written by The Onion —or perhaps its latest viral media parody spinoff Clickhole —the PGPD explains that its decision to employ this “unprecedented social media tactic” stems from the desire to shame prostitutes and others involved in “the oldest profession” and to let them know that “this type of criminal behavior is not welcome in Prince George’s County.” According to information provided on their Blogger, Twitter, and Facebook accounts, the PGPD will be documenting the planned takedown with frequent updates during the arrests, tweeting photos and arrestee information. The planned takedown in Maryland will target johns, not prostitutes themselves, and will be set up using online ads, according to the department. The PGPD elaborated: Read 4 remaining paragraphs | Comments

Link:
Maryland police to live-tweet prostitution sting

NASA decides on crowdsourced Tron look for Mars Z-2 spacesuit

NASA The winning Z-2 suit design, “Technology,” standing triumphantly on a 3D-rendered martian rocky outcropping. 14 more images in gallery NASA announced today that it has  finalized the look for its new Mars-bound Z-2 space suit. The design was selected by the public in a vote, and the winning design was one of three showcased by the agency . The new suit is the latest in NASA’s Z-series of suits. These are a far cry from the simple pressure suits worn by the Mercury astronauts in the 1950s—today’s suits aren’t so much suits as person-shaped spaceships. The Z-series suits are being designed to function both in space and also on the ground on other worlds, most notably the moon and Mars. The major design focuses of the Z-series, and the Z-2 in particular, are mobility and ease of use. Since the earliest days of space travel, suited astronauts needed to cope with the tremendous physical burden of working inside what is essentially a rigid pressurized balloon; an air-filled space suit resists bending, and multi-hour spacewalks can be exhausting. Future suits like the Z-series try to help out their occupants with new materials and clever joint designs, not to mention by allowing astronauts to vary their pressurization level. Read 2 remaining paragraphs | Comments

Visit site:
NASA decides on crowdsourced Tron look for Mars Z-2 spacesuit

Zero-day Flash bug under active attack in Windows threatens OS X, Linux too

A fragment of the shellcode exploiting a critical vulnerability in Adobe Flash. Kaspersky Lab A day after reports that attackers are exploiting a zero-day vulnerability in Microsoft’s Internet Explorer browser , researchers warned of a separate active campaign that was targeting a critical vulnerability in fully patched versions of Adobe’s ubiquitous Flash media player. The attacks were hosted on the Syrian Ministry of Justice website at hxxp://jpic.gov.sy and were detected on seven computers located in Syria, leading to theories that the campaign targeted dissidents complaining about the government of President Bashar al-Assad, according to a blog post published Monday by researchers from antivirus provider Kaspersky Lab. The attacks exploited a previously unknown vulnerability in Flash when people used the Firefox browser to access a booby-trapped page. The attackers appear to be unrelated to those reported on Sunday who exploited a critical security bug in Internet Explorer, a Kaspersky representative told Ars. While the exploit Kaspersky observed attacked only computers running Microsoft Windows, the underlying flaw, which is formally categorized as CVE-2014-1776  and resides in a Flash component known as the Pixel Bender, is present in the Adobe application built for OS X and Linux machines as well. Adobe has updated all three versions to plug the hole. Because security holes frequently become much more widely exploited in the hours or days after they are disclosed, people on all three platforms should update as soon as possible . People using IE 10 and 11 on Windowws 8 will receive the update automatically, as will users of Google’s Chrome browser. It can sometimes take hours for the automatic updates to arrive. Those who are truly cautious should consider manually installing them. Read 4 remaining paragraphs | Comments

More here:
Zero-day Flash bug under active attack in Windows threatens OS X, Linux too

Review: Gigabyte’s AMD Brix gives Intel’s mini PC a run for its money

Gigabyte’s AMD Brix (top) is, if anything, even smaller than Intel’s latest NUC (bottom). Andrew Cunningham When AMD sent us the Brix Gaming for review, it wasn’t alone in its box. We were also sent another, smaller Brix with an AMD processor, and it’s the antithesis of its big loud cousin. It’s basically the AMD take on the NUC : a small, quiet, unobtrusive little box that still tries to deliver the features and performance of a full-size entry-level desktop. We originally planned to review both in one shot, but there was so much to say about the Brix Gaming that the GB-BXA8-5545 (say that three times fast) got edged out. Rather than bury it, we’ve decided to give it its own evaluation. It’s the only AMD-powered desktop in the same size category as the NUC that doesn’t use a wimpy netbook-class processor. And as much as Intel’s integrated GPUs have improved in recent years, the name “AMD” still means something when it comes to graphics performance. Surprise, it’s a tiny cube! Like most other mini PCs, the Brix is a tiny box with a small external power supply. Andrew Cunningham Specs at a glance: Gigabyte Brix GB-BXA8-5545 OS Windows 8.1 x64 CPU 1.7GHz AMD A8-5545M, Turbo Boost up to 2.7GHz available with proper BIOS settings RAM 8GB 1333MHz DDR3 (supports up to 16GB) GPU AMD Radeon 8510G (integrated) HDD 128GB Crucial M500 mSATA SSD Networking 2.4GHz 802.11n Wi-Fi, Bluetooth 4.0, Gigabit Ethernet Ports 4x USB 3.0, 1x mini DisplayPort 1.2, 1x HDMI 1.4a, audio Size 4.24” x 4.5” x 1.18” (107.6 x 114.4 29.9 mm) Other perks Kensington lock, VESA mounting bracket Warranty 1 year Price $249.99 (barebones), $494.97 with listed components and software The other Brix boxes we’ve reviewed have been larger and more powerful machines, but the smaller Intel and AMD-based Brixes are a lot more like the original Intel NUC. This one’s a short, square little device that’s actually a little shorter than the NUC. It’s an understated all-black system with matte metal sides and a glossy plastic top, and while it has an external power brick it doesn’t add much to the total size of the package. With the adapters, it’s roughly the size you’d get with standard PC laptops and Ultrabooks, since the Brix uses low-voltage mobile parts rather than full-fledged desktop chips. Read 17 remaining paragraphs | Comments

View article:
Review: Gigabyte’s AMD Brix gives Intel’s mini PC a run for its money