Tag: golf

“SpecialisRevelio!” Macs use Harry Potter spell to unlock secret “backdoor”

Aurich Lawson / Warner Bros. Entertainment The Mac on your desk or on the cafe table next to you has a chip with secret functions that can be unlocked only by inputting a spell from the Harry Potter series. The SMC, or system management controller, is a chip used to regulate a Mac’s current and voltage, manage its light sensor, and temporarily store FileVault keys. Turns out that the SMC contains undocumented code that is invoked by entering the word “SpecialisRevelio,” the same magic words used to reveal hidden charms, hexes, or properties used by wizards in the Harry Potter  series written by author J. K. Rowling. That fun fact was presented Wednesday at the NoSuchCon security conference by veteran reverse engineer Alex Ionescu. While most details are far too technical for this article, the gist of the research is that the SMC is a chip that very few people can read but just about anyone with rudimentary technical skills can “flash” update. Besides displaying the Apple engineers’ affinity for Harry Potter, Ionescu’s tinkerings also open the door to new types of hacks. But don’t worry because they’re mostly the fodder for a hacking scene in a James Bond or Mission Impossible screenplay. “The attacks discussed in my presentation are attacks that likely only a nation-state adversary would have the sufficient technical knowledge to implement, and they require precise knowledge of the machine that is being targeted,” Ionescu, who is chief architect at security firm CrowdStrike, wrote in an e-mail to Ars. “They are perfect, for example, at a border crossing where a rogue country may need to ‘take a quick look at your laptop’ to ‘help prevent terrorism.’ I don’t suspect most Mac users (and certainly not those that read Ars or other similar publications) would be at a high-profile enough level to warrant such level of interest from another state.” Read 7 remaining paragraphs | Comments

View post:
“SpecialisRevelio!” Macs use Harry Potter spell to unlock secret “backdoor”

Steam players can now earn coupons for new games by playing old ones

A profile decked out with the spoils of a trading card collection. Cool, but go back to the part about coupons? Steam Steam will release a new beta feature within its service called Steam Trading Cards according to  an announcement from the company. The trading cards integrate with a handful of Valve titles at launch, and players that collect the cards will be able to use them to earn coupons as well as profile backgrounds and other items to augment their Steam experience. The launch titles that will generate trading cards to collect include Don’t Starve, Dota 2, Counter-Strike: Global Offensive, Team Fortress 2, Portal 2 and Half-Life 2 . When players get a particular set of cards they can craft them into a game badge to get “marketable items” like emoticons, profile backgrounds, and coupons for things like game discounts or DLC. The badges can then be upgraded, or “leveled up,” by collecting the same set again. The info page states that half of any card set is dropped during game play while the other half is “earned through collecting prowess.” Badges contribute to a player’s “Steam Level,” and as that number rises players get account-bound items including extra friend list slots. Read 1 remaining paragraphs | Comments

See more here:
Steam players can now earn coupons for new games by playing old ones

Critical Linux vulnerability imperils users, even after “silent” fix

Wikipedia For more than two years, the Linux operating system has contained a high-severity vulnerability that gives untrusted users with restricted accounts nearly unfettered “root” access over machines, including servers running in shared Web hosting facilities and other sensitive environments. Surprisingly, most users remain wide open even now, more than a month after maintainers of the open-source OS quietly released an update that patched the gaping hole. The severity of the bug, which resides in the Linux kernel’s “perf,” or performance counters subsystem, didn’t become clear until Tuesday, when attack code exploiting the vulnerability became publicly available (note: some content on this site is not considered appropriate in many work environments). The new script can be used to take control of servers operated by many shared Web hosting providers, where dozens or hundreds of people have unprivileged accounts on the same machine. Hackers who already have limited control over a Linux machine—for instance, by exploiting a vulnerability in a desktop browser or a Web application—can also use the bug to escalate their privileges to root. The flaw affects versions of the Linux kernel from 2.6.37 to 3.8.8 that have been compiled with the CONFIG_PERF_EVENTS kernel configuration option. “Because there’s a public exploit already available, an attacker would simply need to download and run this exploit on a target machine,” Dan Rosenberg, a senior security researcher at Azimuth Security , told Ars in an e-mail. “The exploit may not work out-of-the-box on every affected machine, in which case it would require some fairly straightforward tweaks (for someone with exploit development experience) to work properly.” Read 4 remaining paragraphs | Comments

Link:
Critical Linux vulnerability imperils users, even after “silent” fix

Feds seize money from Dwolla account belonging to top Bitcoin exchange Mt. Gox

jurvetson The Department of Homeland Security has apparently shut down a key mobile payments account associated with Mt. Gox, the largest Bitcoin exchange. Chris Coyne, the co-founder of online dating service OKCupid, tweeted out an e-mail he received from Dwolla this afternoon. The e-mail states that neither Coyne, nor presumably any other Dwolla user, will be able to transfer funds to Mt. Gox. Dwolla confirmed the change to the New York Observer , which first reported the story. Dwolla received a seizure warrant from a federal court. Read 4 remaining paragraphs | Comments

See the original post:
Feds seize money from Dwolla account belonging to top Bitcoin exchange Mt. Gox

The British ‘Atlantis’ is mapped in detail

Dunwich Beach Sutterstock A professor of physical geography has put together the most detailed map yet of the sunken medieval town of Dunwich using underwater acoustic imagining. The port town, often referred to as “the British Atlantis,” was a hub of activity up until its collapse in the 1400s. This was brought about after a series of epic storms battered the coastline in the 1200s and 1300s, causing repeated flooding, submerging parts of the town, and flooding the harbor and river with silt. Today it stands as a small village, but up until its demise it was around the same size as medieval London. Despite still existing at depths of just three to 10 meters (or, 9.8 ft to 32.8 ft) below sea level, the murky conditions have made investigating what lies beneath particularly tricky. Since 2010, however, Southampton’s David Sear—along with the GeoData Institute, the National Oceanography Center, Wessex Archaeology, and local divers from North Sea Recovery and Learn Scuba—has been exploring the muddy depths using dual-frequency identification sonar (DIDSON) acoustic imaging. Read 8 remaining paragraphs | Comments

Read More:
The British ‘Atlantis’ is mapped in detail

How hackers allegedly stole “unlimited” amounts of cash from banks in just hours

Wikipedia Federal authorities have accused eight men of participating in 21st-Century Bank heists that netted a whopping $45 million by hacking into payment systems and eliminating withdrawal limits placed on prepaid debit cards. The eight men formed the New York-based cell of an international crime ring that organized and executed the hacks and then used fraudulent payment cards in dozens of countries to withdraw the loot from automated teller machines, federal prosecutors alleged in court papers unsealed Thursday. In a matter of hours on two separate occasions, the eight defendants and their confederates withdrew about $2.8 million from New York City ATMs alone. At the same times, “cashing crews” in cities in at least 26 countries withdrew more than $40 million in a similar fashion. Prosecutors have labeled this type of heist an “unlimited operation” because it systematically removes the withdrawal limits normally placed on debit card accounts. These restrictions work as a safety mechanism that caps the amount of loss that banks normally face when something goes wrong. The operation removed the limits by hacking into two companies that process online payments for prepaid MasterCard debit card accounts issued by two banks—the National Bank of Ras Al-Khaimah PSC in the United Arab Emirates and the Bank of Muscat in Oman—according to an indictment filed in federal court in the Eastern District of New York. Prosecutors didn’t identify the payment processors except to say one was in India and the other in the United States. Read 3 remaining paragraphs | Comments

Taken from:
How hackers allegedly stole “unlimited” amounts of cash from banks in just hours

Network Solutions seizes over 700 domains registered to Syrians

While Syria’s Internet connection is back up, many of the sites hosted in Damascus have lost their domain names. As Brian Krebs of Krebs on Security reports , the domain registrar Network Solutions LLC has taken control of 708 domain names in the .com, .org, and .net top-level domains registered to Syrian organizations. The organizations affected by the seizure include the state-supported hacker group Syrian Electronic Army. Usually when there’s a domain name seizure, it’s the work of government agencies like Immigrations and Customs Enforcement or the FBI, or domains are shut down with the help of US Marshals as part of a court-sanctioned seizure related to malware. But in this case, Network Solutions appears to have seized the domains in question without coordinating with federal authorities, though its action was guided by federal regulations—domain name registration is one of the services explicitly banned in US trade sanctions enacted against Syria last year. Network Solutions has marked the seized domains with the notation “OFAC Holding,” indicating they were taken over in accordance with regulations propagated by the Department of the Treasury’s  Office of Foreign Assets Control , a unit of Treasury’s Office of Terrorism and Financial Intelligence. The vast majority of the seized domains were pointed at IP addresses assigned to the Syrian Computer Society. As we’ve reported previously, Syrian President Bashar al-Assad, who was an Army doctor and ophthalmologist before being groomed to take over for his father, was head of the Syrian Computer Society in the 1990s. He became president in 2000. The Syrian Computer Society acts as Syria’s domain registration authority and regulates the Internet within Syria, and is also believed to be connected to Syria’s state security apparatus. The Syrian Computer Society registered .sy domain names for the Syrian Electronic Army’s servers, giving the hacker group a national-level domain name (sea.sy) rather than a .com or other non-government address, signifying its status as at least a state-supervised operation. Read 1 remaining paragraphs | Comments

See the article here:
Network Solutions seizes over 700 domains registered to Syrians

Cray brings top supercomputer tech to businesses for a mere $500,000

A Cray XC30-AC server rack. Cray Cray, the company that built the world’s fastest supercomputer, is bringing its next generation of supercomputer technology to regular ol’ business customers with systems starting at just $500,000. The new XC30-AC systems announced today range in price from $500,000 to roughly $3 million, providing speeds of 22 to 176 teraflops. That’s just a fraction of the speed of the aforementioned world’s fastest supercomputer, the $60 million  Titan , which clocks in at 17.59 petaflops. (A teraflop represents a thousand billion floating point operations per second, while a petaflop is a million billion operations per second.) But in fact, the processors and interconnect used in XC30-AC is a step up from those used to build Titan. The technology Cray is selling to smaller customers today could someday be used to build supercomputers even faster than Titan. Read 19 remaining paragraphs | Comments

View article:
Cray brings top supercomputer tech to businesses for a mere $500,000

Why Apple added debt to its $145 billion cash hoard

Anton TwAng Apple is making headlines with rumors of a record-sized bond sale. According to reports, Cupertino is likely taking advantage of historically dirt-cheap interest rates on corporate debt by raising about $17 billion from a series of six types of bond papers. It’s not the largest non-bank bond sale in history, but it does rank near the top. Automaker General Motors raised $17.5 billion in bond financing a decade ago, for example. Then again, GM’s financing arm, then known as GMAC, sort of made a bank out of the car builder. Pharma giants Abbott Laboratories and Roche Holdings also issued $14.7 billion and $16 billion in bond debt fairly recently. Record-level or not, Apple’s sale certainly ranks right up there with the big boys. Read 13 remaining paragraphs | Comments

Read this article:
Why Apple added debt to its $145 billion cash hoard

Original iPhone to go the way of the dodo on June 11, 2013

Oh original iPhone, we’ll miss you. Roughly six years after its public launch, the original iPhone is about to become obsolete—at least in Apple’s eyes. Apple reportedly sent out internal documentation to its support partners, which was then passed on to 9to5Mac , detailing which of its products would no longer be considered current or recent devices as of June 11, 2013. The list doesn’t just include the original iPhone, though: it also includes a number of older iMacs, MacBook Pros, Xserves, and PowerBooks. According to the document , products that are considered obsolete—or perhaps for a more tasteful term, “vintage”—cannot be repaired or receive replacement parts unless they’re in the state of California, “as required by statute.” Californians can continue to get service and parts for their obsolete items through Apple retail stores, but the rest of us are pretty much out of luck. Apple notes that obsolete or vintage products can’t be serviced as mail-in repairs to AppleCare, either. This is pretty standard procedure for Apple; the other products in the list are about as old as the original iPhone, and some of them are even older (there’s a Mac mini on the list from 2005, and don’t even get us started on PowerBooks). All we know is that if you’re still actively using an original iPhone, you must have an amazing tolerance for outdated software and slow hardware. Good on you, but perhaps it’s time to think about an upgrade. Read 1 remaining paragraphs | Comments

Read the original post:
Original iPhone to go the way of the dodo on June 11, 2013