Tag: portfolio-cond

Adobe ships new features, new apps, exclusively to cloud subscribers

Adobe today shipped the first public preview of Edge Reflow. First shown off last September , the new application for responsive Web design is designed to make it easier for developers to produce webpages that alter their layout in response to changes in screen size, enabling the same page to be used on both desktop and portable devices. The company is also shipping an update for three other tools. It’s adding direct support for using the free Edge Web Fonts to its Web development app Dreamweaver and its timeline-based animation software Edge Animate. Edge Animate is also picking up new support for CSS gradients. Finally, the Edge Code HTML editor, currently available as a preview, is being updated to support live previewing and a quick edit mode that allows scripts and styles to be edited where they’re used even when they’re stored in separate files. The new Edge Reflow app looks handy for those interested in responsive Web design, and the other improvements are pleasant if incremental. The most significant thing is not the updates themselves, however, but the fact that they’re being made exclusive to Creative Cloud subscribers. Buyers of the traditional perpetually licensed versions of Creative Suite are excluded. Read 3 remaining paragraphs | Comments

Excerpt from:
Adobe ships new features, new apps, exclusively to cloud subscribers

A world of hurt after McAfee mistakenly revokes key for signing Mac apps

Travis Nep Smith A McAfee administrator accidentally revoked the digital key used to certify desktop applications that run on Apple’s OS X platform, creating headaches for customers who want to install or upgrade Mac antivirus products. A certificate revocation list  [CRL] hosted by Apple Worldwide developer servers lists the reason for the cancellation as a “key compromise,” but McAfee officials said they never lost control of the sensitive certificate which is used to prove applications are legitimate releases. The revocation date shows as February 6, meaning that for seven days now, customers have had no means to validate McAfee applications they want to install on Macs. “We were told that as a workaround, we should just allow untrusted certificates until they figure it out,” an IT administrator at a large organization, who asked that he not be identified, told Ars. “They’re telling us to trust untrusted certs, and that definitely puts us at risk.” Read 6 remaining paragraphs | Comments

View the original here:
A world of hurt after McAfee mistakenly revokes key for signing Mac apps

How alleged crooks used ATM skimmers to compromise thousands of accounts

Federal authorities have charged two men suspected of running an international operation that used electronic devices planted at automatic teller machine locations to compromise more than 6,000 bank accounts. The operation—which targeted Capital One, J. P. Morgan Chase, and other banks—netted, or attempted to net, about $3 million according to an indictment filed in Manhattan federal court. It allegedly worked by obtaining payment card readers from Hungary and other countries and installing them on top of card readers already located on ATMs and doors to ATM vestibules. The fraudulent readers were equipped with hardware that recorded the information encoded onto a card’s magnetic stripe each time it was inserted. A hidden pinhole camera with a view of the ATM keypad then captured the corresponding personal identification number. Antonio Gabor and Simion Tudor Pintillie allegedly led a gang of at least nine other people who regularly planted the skimming devices in the Manhattan, Chicago, and Milwaukee metropolitan areas, prosecutors said. They would later revisit the ATM to retrieve the information stored on the skimming devices and cameras. Gang members would then encode the stolen data onto blank payment cards and use the corresponding PINs to make fraudulent purchases or withdrawals. Read 3 remaining paragraphs | Comments

Taken from:
How alleged crooks used ATM skimmers to compromise thousands of accounts

Apple releases iOS 6.1.1 for iPhone 4S users with 3G issues (Updated)

Update : Apple has now released the iOS 6.1.1 update mentioned in our original writeup. The update is specifically for the iPhone 4S and “fixes an issue that could impact cellular performance and reliability for iPhone 4S.” This is most likely to address the 3G issues experienced by some users, though it doesn’t sound like iOS 6.1.1 does anything to improve battery life as of yet. Original story : iOS 6.1.1 may be making its way into consumers’ hands sooner than we expected. The first beta of iOS 6.1.1 was only released to Apple’s developer network last week, but the update is reportedly being “rushed” out to customers in order to address 3G performance bugs, according to German iPhone site iFun . It is also said to address other problems like reduced battery life. The software is said to have undergone some carrier testing, though it’s still unclear exactly when Apple plans to publish the update. Read 4 remaining paragraphs | Comments

Original post:
Apple releases iOS 6.1.1 for iPhone 4S users with 3G issues (Updated)

At Facebook, zero-day exploits, backdoor code bring war games drill to life

Aurich Lawson Early on Halloween morning, members of Facebook’s Computer Emergency Response Team received an urgent e-mail from an FBI special agent who regularly briefs them on security matters. The e-mail contained a Facebook link to a PHP script that appeared to give anyone who knew its location unfettered access to the site’s front-end system. It also referenced a suspicious IP address that suggested criminal hackers in Beijing were involved. “Sorry for the early e-mail but I am at the airport about to fly home,” the e-mail started. It was 7:01am. “Based on what I know of the group it could be ugly. Not sure if you can see it anywhere or if it’s even yours.” The e-mail reporting a simulated hack into Facebook’s network. It touched off a major drill designed to test the company’s ability to respond to security crises. Facebook Facebook employees immediately dug into the mysterious code. What they found only heightened suspicions that something was terribly wrong. Facebook procedures require all code posted to the site to be handled by two members of its development team, and yet this script somehow evaded those measures. At 10:45am, the incident received a classification known as “unbreak now,” the Facebook equivalent of the US military’s emergency DEFCON 1 rating. At 11:04am, after identifying the account used to publish the code, the team learned the engineer the account belonged to knew nothing about the script. One minute later, they issued a takedown to remove the code from their servers. Read 31 remaining paragraphs | Comments

Link:
At Facebook, zero-day exploits, backdoor code bring war games drill to life

At long last, TI releases graphing calculator for the iPad

A TI-Nspire’s functionality, replicated on an iPad. TI/TechPoweredMath Texas Instruments has brought its graphing calculator functionality to a more modern platform, according to TechPoweredMath . TI-Nspire for iPad mimics the functionality of the color TI-Nspire calculator and has cloud integration for teachers to share files with students. TI’s graphing calculators have been stuck staunchly in the past as much as possible.  Color screens were  a recent development for its most popular line of devices, and developers have had to build games with only a handful of kilobytes of code . As smartphones and tablets rise in popularity, it makes increasing sense to fold the graphing calculator functionality into devices that students are likely carrying around with them anyway. This is not to say graphing calculator apps haven’t existed for some time—they have, for both smartphones and tablets, and many are free. But until now, TI has refused to cross over. Read 3 remaining paragraphs | Comments

Read this article:
At long last, TI releases graphing calculator for the iPad

Adobe issues emergency Flash update for attacks on Windows, Mac users

Adobe Systems has released a patch for two Flash player vulnerabilities that are being actively exploited online to surreptitiously install malware, one in attacks that target users of Apple’s Macintosh platform. While Flash versions for OS X and Windows are the only ones reported to be under attack, Thursday’s unscheduled release is available for Linux and Android devices as well. Users of all affected operating systems should install the update as soon as possible. The Mac exploits target users of the Safari browser included in Apple’s OS X, as well as those using Mozilla’s Firefox. That vulnerability, cataloged as CVE-2013-0634, is also being used in exploits that trick Windows users into opening booby-trapped Microsoft Word documents that contain malicious Flash content, Adobe said in an advisory . Adobe credited members of the Shadowserver Foundation , Lockheed Martin’s Computer Incident Response Team, and MITRE with discovery of the critical bug. Read 4 remaining paragraphs | Comments

Continue Reading:
Adobe issues emergency Flash update for attacks on Windows, Mac users

Securing your website: A tough job, but someone’s got to do it

In 2006, members of a notorious crime gang cased the online storefronts belonging to 7-Eleven, Hannaford Brothers, and other retailers. Their objective: to find an opening that would allow their payment card fraud ring to gather enough data to pull off a major haul. In the waning days of that year they hit the mother lode, thanks to Russian hackers identified by federal investigators as Hacker 1 and Hacker 2. Located in the Netherlands and California, the hackers identified a garden-variety flaw on the website of Heartland Payment Systems, a payment card processor that handled some 100 million transactions per month for about 250,000 merchants. By exploiting the so-called SQL injection vulnerability, they were able to gain a toe-hold in the processor’s network , paving the way for a breach that cost Heartland more than $12.6 million. The hack was masterminded by the now-convicted Albert Gonzalez and it’s among the most graphic examples of the damage that can result from vulnerabilities that riddle just about any computer that serves up a webpage . Web application security experts have long cautioned such bugs can cost businesses dearly, yet those warnings largely fall on deaf ears. But in the wake of the Heartland breach there was no denying the damage they can cause. In addition to the millions of dollars the SQL injection flaw cost Heartland, the company also paid with its loss of reputation among customers and investors. Read 23 remaining paragraphs | Comments

See the original article here:
Securing your website: A tough job, but someone’s got to do it

How Yahoo allowed hackers to hijack my neighbor’s e-mail account

Reflected XSS vulnerabilities in action Aspect Security When my neighbor called early Wednesday morning, she sounded close to tears. Her Yahoo Mail account had been hijacked and used to send spam to addresses in her contact list. Restrictions had then been placed on her account that prevented her from e-mailing her friends to let them know what happened. In a  blog post  published hours before my neighbor’s call, researchers from security firm Bitdefender said that the hacking campaign that targeted my neighbor’s account had been active for about a month. Even more remarkable, the researchers said the underlying hack worked because Yahoo’s developer blog runs on a version of the WordPress content management system that contained a vulnerability developers addressed more than eight months ago . My neighbor’s only mistake, it seems, was clicking on a link while logged in to her Yahoo account. As someone who received one of the spam e-mails from her compromised account, I know how easy it is to click such links. The subject line of my neighbor’s e-mail mentioned me by name, even though my name isn’t in my address. Over the past few months, she and I regularly sent messages to each other that contained nothing more than a Web address, so I thought nothing of opening the link contained in Wednesday’s e-mail. The page that opened looked harmless enough. It appeared to be an advertorial post on MSNBC.com about working from home, which is something I do all the time. But behind the scenes, according to Bitdefender, something much more nefarious was at work. Read 9 remaining paragraphs | Comments

Read More:
How Yahoo allowed hackers to hijack my neighbor’s e-mail account

To prevent hacking, disable Universal Plug and Play now

Security experts are advising that a networking feature known as Universal Plug and Play be disabled on routers, printers, and cameras, after finding it makes tens of millions of Internet-connected devices vulnerable to serious attack. UPnP, as the feature is often abbreviated, is designed to make it easy for computers to connect to Internet gear by providing code that helps devices automatically discover each other over a local network. That often eliminates the hassle of figuring out how to configure devices the first time they’re connected. But UPnP can also make life easier for attackers half a world away who want to compromise a home computer or breach a business network, according to a white paper published Tuesday by researchers from security firm Rapid7. Over a five-and-a-half-month period last year, the researchers scanned every routable IPv4 address about once a week. They identified 81 million unique addresses that responded to standard UPnP discovery requests, even though the standard isn’t supposed to communicate with devices that are outside a local network. Further scans revealed 17 million addresses exposed UPnP services built on the open standard known as SOAP, short for simple object access protocol. By broadcasting the service to the Internet at large, the devices can make it possible for attackers to bypass firewall protections. Read 5 remaining paragraphs | Comments

Read More:
To prevent hacking, disable Universal Plug and Play now