Tag: internet

Critical vulnerability under “massive” attack imperils high-impact sites [Updated]

Enlarge / One of two publicly available exploits for a critical Apache Struts vulnerability. (credit: Kevin Beaumont ) In a string of attacks that have escalated over the past 48 hours, hackers are actively exploiting a critical vulnerability that allows them to take almost complete control of Web servers used by banks, government agencies, and large Internet companies. The code-execution bug resides in the Apache Struts 2 Web application framework and is trivial to exploit. Although maintainers of the open source project patched the vulnerability on Monday , it remains under attack by hackers who are exploiting it to inject commands of their choice into Struts servers that have yet to install the update, researchers are warning. Making matters worse, at least two working exploits are publicly available. “If you run it against a vulnerable application, the result will be the remote execution of commands with the user running the server,” Vicente Motos wrote of one of the exploits in a post published late Wednesday afternoon on the Hack Players website. “We have dedicated hours to reporting to companies, governments, manufacturers, and even individuals to patch and correct the vulnerability as soon as possible, but the exploit has already jumped to the big pages of ‘advisories,’ and massive attempts to exploit the Internet have already been observed.” Read 8 remaining paragraphs | Comments

Originally posted here:
Critical vulnerability under “massive” attack imperils high-impact sites [Updated]

School Assignment Leads to Discovery of WWII Plane With Pilot’s Body Still Inside

When 14-year-old Daniel Kristiansen was assigned a World War II project for history class, his father jokingly suggested he look for a German plane that had allegedly crashed at the family farm. Well wouldn’t you know it, he actually found the damned thing—along with the dead airman’s remains. It’s being called one of… Read more…

View article:
School Assignment Leads to Discovery of WWII Plane With Pilot’s Body Still Inside

Scientists Finally Observed Time Crystals—But What the Hell Are They?

My first question was, “What is a time crystal?” Harvard graduate students Soonwon Choi, Joonhee Choi and postdoctoral researcher Renate Landig all started laughing. “That’s a very good question, ” said Soonwon. The time crystal’s silly science fiction name shrouds its deep quantum mechanical nuance. Sometimes a name… Read more…

More:
Scientists Finally Observed Time Crystals—But What the Hell Are They?

Mozilla Firefox 52 Released As ESR Branch, Will Receive Security Updates Until 2018

prisoninmate quotes a report from Softpedia: Back in January, we told you that the development of the Mozilla Firefox 52.0 kicked off with the first Beta release and promised to let users send and open tabs from one device to another, among numerous other improvements and new features. Nine beta builds later, Mozilla has pushed today, March 7, the final binary and source packages of the Mozilla Firefox 52.0 web browser for all supported platforms, including GNU/Linux, macOS, and Windows. The good news is that Firefox 52.0 is an ESR (Extended Support Release) branch that will be supported until March-April 2018. Prominent features of the Mozilla Firefox 52.0 ESR release include support for the emerging WebAssembly standard to boost the performance of Web-based games and apps without relying on plugins, the ability to send and open tabs from one device to another, as well as multi-process for Windows users with touchscreens. With each new Firefox release, Mozilla’s developers attempt to offer new ways to improve the security of the widely-used web browser across all supported platforms. Firefox 52.0 ESR implements a “This connection is not secure” warning for non-secure pages that require user logins, along with a new Strict Secure Cookies specification. Read more of this story at Slashdot.

Read the article:
Mozilla Firefox 52 Released As ESR Branch, Will Receive Security Updates Until 2018

University of California, Berkeley, To Delete Publicly Available Educational Content

In response to a U.S. Justice Department order that requires colleges and universities make website content accessible for citizens with disabilities and impairments, the University of California, Berkeley, will cut off public access to tens of thousands of video lectures and podcasts. Officials said making the videos and audio more accessible would have proven too costly in comparison to removing them. Inside Higher Ed reports: Today, the content is available to the public on YouTube, iTunes U and the university’s webcast.berkeley site. On March 15, the university will begin removing the more than 20, 000 audio and video files from those platforms — a process that will take three to five months — and require users sign in with University of California credentials to view or listen to them. The university will continue to offer massive open online courses on edX and said it plans to create new public content that is accessible to listeners or viewers with disabilities. The Justice Department, following an investigation in August, determined that the university was violating the Americans With Disabilities Act of 1990. The department reached that conclusion after receiving complaints from two employees of Gallaudet University, saying Berkeley’s free online educational content was inaccessible to blind and deaf people because of a lack of captions, screen reader compatibility and other issues. Cathy Koshland, vice chancellor for undergraduate education, made the announcement in a March 1 statement: “This move will also partially address recent findings by the Department of Justice, which suggests that the YouTube and iTunes U content meet higher accessibility standards as a condition of remaining publicly available. Finally, moving our content behind authentication allows us to better protect instructor intellectual property from ‘pirates’ who have reused content for personal profit without consent.” Read more of this story at Slashdot.

See original article:
University of California, Berkeley, To Delete Publicly Available Educational Content

Hidden Backdoor Discovered In Chinese IoT Devices

“A backdoor has been found in devices made by a Chinese tech firm specializing in VoIP products, ” reports TechRadar. An anonymous reader quotes their article: Security outfit Trustwave made the discovery of a hidden backdoor in DblTek’s devices which was apparently put there to allow the manufacturer access to said hardware — but of course, it’s also open to being exploited by other malicious parties. The backdoor is in the Telnet admin interface of DblTek-branded devices, and potentially allows an attacker to remotely open a shell with root privileges on the target device. What’s perhaps even more worrying is that when Trustwave contacted DblTek regarding the backdoor last autumn — multiple times — patched firmware was eventually released at the end of December. However, rather than removing the flaw, the vendor simply made it more difficult to access and exploit. And further correspondence with the Chinese company has apparently fallen on deaf ears. The firmware with the hole “is present on almost every GSM-to-VoIP device which DblTek makes, ” and Trustwave “found hundreds of these devices on the net, and many other brands which use the same firmware, so are equally open to exploit.” Read more of this story at Slashdot.

See the original article here:
Hidden Backdoor Discovered In Chinese IoT Devices

Bill Would Legalize Active Defense Against Hacks

Trailrunner7 quotes a report from On the Wire: A new bill intended to update the Computer Fraud and Abuse Act would allow victims of computer attacks to engage in active defense measures to identify the attacker and disrupt the attack. Proposed by Rep. Tom Graves (R-Ga.), the bill would grant victims of computer intrusions unprecedented rights. Known as the Active Cyber Defense Certainty Act, the legislation seeks to amend the CFAA, the much-maligned 1986 law that is used in most computer crime prosecutions. The proposed legislation includes the caveat that victims can’t take any actions that destroy data on another person’s computer, causes physical injury to someone, or creates a threat to public safety. The concept of active defense has been a controversial one in the security community for several years, with many experts saying the potential downside outweighs any upside. Not to mention that it’s generally illegal. Read more of this story at Slashdot.

Original post:
Bill Would Legalize Active Defense Against Hacks

Facebook Finally Rolls Out ‘Disputed News’ Tag Everyone Will Dispute

On Friday, Facebook debuted its new flagging system for fake news in America, tagging hoax stories as “disputed” for some users. First announced amid criticism of the company for its role in spreading misinformation during the 2016 election, the new feature uses non-partisan third parties to assess the factual… Read more…

More here:
Facebook Finally Rolls Out ‘Disputed News’ Tag Everyone Will Dispute

How to Get Windows and macOS Apps on Your Chromebook

As capable as Chromebooks have become , there are times when you might need to load up Photoshop, iTunes or something else that relies on Windows or macOS. Not only can Chrome OS do this, it’s not that difficult to set up…if you know the right plug-ins to use. Here’s how to get started. Read more…

More here:
How to Get Windows and macOS Apps on Your Chromebook

Netflix Uses AI in Its New Codec To Compress Video Scene By Scene

An anonymous reader shares a Quartz report: Annoying pauses in your streaming movies are going to become less common, thanks to a new trick Netflix is rolling out. It’s using artificial intelligence techniques to analyze each shot in a video and compress it without affecting the image quality, thus reducing the amount of data it uses. The new encoding method is aimed at the growing contingent of viewers in emerging economies who watch video on phones and tablets. “We’re allergic to rebuffering, ” said Todd Yellin, a vice president of innovation at Netflix. “No one wants to be interrupted in the middle of Bojack Horseman or Stranger Things.” Yellin hopes the new system, called Dynamic Optimizer, will keep those Netflix binges free of interruption when it’s introduced sometime in the next “couple of months.” He was demonstrating the system’s results at “Netflix House, ” a mansion in the hills overlooking Barcelona that the company has outfitted for the Mobile World Congress trade show. In one case, the image quality from a 555 kilobits per second (kbps) stream looked identical to one on a data link with half the bandwidth. Read more of this story at Slashdot.

More:
Netflix Uses AI in Its New Codec To Compress Video Scene By Scene