Tag: reprints

Breaking 512-bit RSA with Amazon EC2 is a cinch. So why all the weak keys?

(credit: martinak15 ) The cost and time required to break 512-bit RSA encryption keys has plummeted to an all-time low of just $75 and four hours using a recently published recipe that even computing novices can follow. But despite the ease and low cost, reliance on the weak keys to secure e-mails, secure-shell transactions, and other sensitive communications remains alarmingly high. The technique, which uses Amazon’s EC2 cloud computing service , is described in a paper published last week titled Factoring as a Service . It’s the latest in a 16-year progression of attacks that have grown ever faster and cheaper. When 512-bit RSA keys were first factored in 1999, it took a supercomputer and hundreds of other computers seven months to carry out. Thanks to the edicts of Moore’s Law – which holds that computing power doubles every 18 months or so – the factorization attack required just seven hours and $100 in March, when “FREAK,” a then newly disclosed attack on HTTPS-protected websites with 512-bit keys , came to light. In the seven months since FREAK’s debut, websites have largely jettisoned the 1990s era cipher suite that made them susceptible to the factorization attack. And that was a good thing, since the factorization attack made it easy to obtain the secret key needed to cryptographically impersonate the webserver or to decipher encrypted traffic passing between the server and end users. But e-mail servers, by contrast, remain woefully less protected. According to the authors of last week’s paper, the RSA_EXPORT cipher suite is used by an estimated 30.8 percent of e-mail services using the SMTP protocol , 13 percent of POP3S servers . and 12.6 percent of IMAP-based e-mail services . Read 6 remaining paragraphs | Comments

See more here:
Breaking 512-bit RSA with Amazon EC2 is a cinch. So why all the weak keys?

Scientists grow functional kidney organoid from stem cells

A drawing shows the complex structure of a kidney. (credit: Wikimedia commons ) There are many diseases that attack specific organs, landing patients on a transplant list. Unfortunately, our bodies have markers that identify an organ as “self,” which makes it difficult to find an organ match. Many individuals die waiting for an organ transplant because a match can’t be found. Research on stem cells—a type of cell that is able to transform into nearly any cell type—has raised hopes of treating organ failure. Researchers envision using these cells to grow fully functional organs. A functional organ is similar to a machine. Organs contain many interacting parts that must be positioned in a specific configuration to work properly. Getting all the right cell types in the appropriate locations is a real challenge. Recently, a team of scientists has met that challenge by using stem cells to grow a tissue, termed an organoid, that resembles a developing kidney. Read 8 remaining paragraphs | Comments

Continue reading here:
Scientists grow functional kidney organoid from stem cells

Toyota 2050 plans to cut CO2 from its new cars by 90 percent

Earlier today, Toyota unveiled a bold new plan for the company’s sustainability efforts. By the year 2050, it plans to have cut CO 2 emissions from its new cars by 90 percent (compared to 2010). Toyota also wants to completely eliminate CO 2 pollution from new car manufacturing, as well as over the entire lifecycle of a car including its recycling. These are bold goals. The company says it will build off the success of its Prius hybrids to cut vehicle emissions. Advanced hybrid powertrains will be a big research focus, and the company even gave a shout-out to silicon carbide supercapacitors. In addition, big things are planned for hydrogen. The Japanese government has been incentivizing its car industry to work with fuel cells, and road cars are starting to appear. The Toyota Mirai is already in production and coming to America, even if the fueling stations it will depend upon are few and far between. Completely eradicating CO 2 from the production and recycling of new cars is an equally big challenge. The company wants all its production factories to have zero emissions, in part through renewable energy and fuel cells. And it has goals to promote recycling and conservation around the world. More specifics are included in Toyota’s new environmental action plan —its sixth so far—which runs from 2016-2020. That means it will be a few years before we can judge if Toyota’s commitment to the environment is succeeding. Read on Ars Technica | Comments

Visit site:
Toyota 2050 plans to cut CO2 from its new cars by 90 percent

University of Cambridge study finds 87% of Android devices are insecure

The study’s estimate of the proportion of known “insecure,” “maybe secure” and “secure” devices over time. (credit: androidvulnerabilities.org ) It’s easy to see that the Android ecosystem currently has a rather lax policy toward security, but a recent study from the University of Cambridge put some hard numbers to Android’s security failings. The conclusion finds that “on average 87.7% of Android devices are exposed to at least one of 11 known critical vulnerabilities.” Data for the study was collected through the group’s ” Device Analyzer ” app, which has been available for free on the Play Store since May 2011. After the participants opted into the survey, the University says it collected daily Android version and build number information from over 20,400 devices. The study then compared this version information against 13 critical vulnerabilities (including the Stagefright vulnerabilities ) dating back to 2010. Each individual device was then labeled “secure” or “insecure” based on whether or not its OS version was patched against these vulnerabilities, or placed in a special “maybe secure” category if it could have gotten a specialized, backported fix. As for why so many Android devices are insecure, the study found that most of the blame sits with OEMs. The group states that “the bottleneck for the delivery of updates in the Android ecosystem rests with the manufacturers, who fail to provide updates to fix critical vulnerabilities.” Along with the study, the University of Cambridge is launching ” AndroidVulnerabilities.org ,” a site that houses this data and grades OEMs based on their security record. The group came up with a 1-10 security rating for OEMs that it calls the “FUM” score. This algorithm takes into account the number of days a proportion of running devices has no known vulnerabilities ( F ree), the proportion of devices that run the latest version of Android ( U pdate), and the mean number of vulnerabilities not fixed on any device the company sells ( M ean). The study found that Google’s Nexus devices were the most secure out there, with a FUM score of 5.2 out of 10. Surprisingly, LG was next with 4.0, followed by Motorola, Samsung, Sony, and HTC, respectively. Read 3 remaining paragraphs | Comments

Read the article:
University of Cambridge study finds 87% of Android devices are insecure

Webflow’s “first visual CMS” is like WordPress mixed with Photoshop

A demo video showing off Webflow CMS. Web design tools like Webflow have done a lot to thin the line between designers and developers. Now, however, the birthed-by-Y-Combinator startup wants to take it further with what it describes as the world’s first visual content management system (CMS). There’s not much to it right now. In a nutshell, Webflow CMS is a barebones WordPress installation jammed into a Photoshop-like interface. The idea here is to provide a way to create “completely custom websites powered by dynamic content” without any knowledge of HTML, CSS, PHP, or databases. And to an extent, it works. The Webflow CMS allows users to create or use pre-existing “Collections”—templates for dynamic content types. From there, you can then determine the kind of fields associated with the Collection, such as whether they’re mandatory to be completed, if they’re to be linked to another Collection, and what kind of minimum word counts are to be expected. These criteria are universal for any instance of the Collection. All Blog Posts, for example, will draw from the parent Blog Posts Collection. Read 4 remaining paragraphs | Comments

Continue reading here:
Webflow’s “first visual CMS” is like WordPress mixed with Photoshop

Unionized video game voice actors overwhelmingly approve strike vote

Members of the SAG-AFTRA union have overwhelmingly approved a measure authorizing an “interactive media” strike that could have wide-ranging impact on the availability of professional voice talent for video game projects. The union announced today that 96.52 percent of its members voted in favor of the strike. That’s well above the 75 percent threshold that was necessary to authorize such a move, and a result the union is calling “a resounding success.” Despite the vote, union members will not strike immediately. Instead, a strike can now be called whenever the union’s National Board decides to declare it. Armed with that knowledge, SAG-AFTRA will be sending its Negotiating Comittee back to talk with major game publishers including EA, Activision, Disney, and Warner Bros., which are signatories to a current agreement with the union. After their old agreement technically expired at the end of 2014, both sides have failed to reach a new understanding in negotiation sessions in February and June. SAG-AFTRA is looking for a number of concessions from the game industry, including “back end bonus” royalties for games that sell at least two million units, “stunt pay” for “vocally stressful” work, and more information to be provided about projects before time-consuming auditions are scheduled. Read 1 remaining paragraphs | Comments

See more here:
Unionized video game voice actors overwhelmingly approve strike vote

Patreon was warned of serious website flaw 5 days before it was hacked

Enlarge / Results of a Shodan search performed on September 11 made it clear Patreon was vulnerable to code-execution attacks. (credit: Detectify) Five days before Patreon.com officials said their donations website was plundered by hackers, researchers at a third-party security firm notified them that a serious programming error could lead to disastrous results. The researchers now believe the vulnerability was the entry point for attackers who went on to publish almost 15 gigabytes’ worth of source code, user password data, and private messages . The error was nothing short of facepalm material. Patreon developers allowed a Web application tool known as the Werkzeug utility library to run on a public-facing subdomain. Specifically, according to researchers at Swedish security firm Detectify , one or more of Patreon’s live Web apps on zach.patreon.com was running Werkzeug debugging functions. A simple query on the Shodan search service brought the goof to the attention of Detectify researchers, who in turn notified Patreon officials on September 23. Adding to their concern, the same Shodan search shows thousands of other websites making the same game-over mistake. Remote code execution by design The reason for the alarm was clear. The Werkzeug debugger allows visitors to execute code of their choice from within the browser. Werkzeug developers have long been clear about this capability and the massive risks that stem from using it in production environments . But in case anyone missed the warning, an independent blogger called attention to the threat last December. Read 6 remaining paragraphs | Comments

Follow this link:
Patreon was warned of serious website flaw 5 days before it was hacked

Sprint continues decline, plans job cuts and cost cuts of $2.5 billion

(credit: Sprint) Sprint’s place among the big four US wireless carriers continues to be a precarious one, with news reports saying the company now aims to reduce its number of employees and cut between $2 billion and $2.5 billion in costs over the next six months. A memo from Sprint management to staff said there will be a hiring freeze and “job reductions,” according to   The Wall Street Journal . Sprint announced days ago that it will skip a major auction of low-band spectrum, a decision that could push the company further behind its rivals. Sprint has licenses to more spectrum than any other carrier, but AT&T and Verizon control a large majority of low-band spectrum, which is ideal for providing coverage over long distances and indoors. T-Mobile says it intends to buy enough low-band spectrum to cover the entire nation; Sprint says it can improve coverage with its existing spectrum by increasing the number of cell towers. Read 4 remaining paragraphs | Comments

Read the article:
Sprint continues decline, plans job cuts and cost cuts of $2.5 billion

Los Angeles schools reach $6.4 million settlement with Apple, Lenovo

(credit: Brad Flickinger ) Last week, the Los Angeles Unified School District (LAUSD) reached a settlement with Apple and Lenovo over a conflict involving software from curriculum provider Pearson. Although the conflict involves Pearson and LAUSD primarily, the curriculum provider was a subcontractor under Apple and Lenovo, so the settlement is between the hardware companies and LAUSD, the Los Angeles Times reports . Apple has agreed to pay LAUSD $4.2 million for the Pearson curriculum, and Lenovo, which also charged the school district for Pearson curriculum, will give the school district $2.2 million in credit for its purchase of laptops. Last year, LAUSD halted the $1.3 billion project to give every student in the massive district an iPad loaded with Pearson’s educational material. The about-face was announced after the Los Angeles Times reported that there had been improprieties in the bidding process for the contract with the school district. In December, the FBI opened an investigation into the iPad program and seized 20 boxes of documents from the LAUSD, just as the school district’s superintendent resigned. Four months later, LAUSD said it would no longer accept shipments of Pearson’s curriculum, and it added that it wanted a “multi-million dollar refund” for copies of Pearson’s software that had already been delivered. Read 2 remaining paragraphs | Comments

View post:
Los Angeles schools reach $6.4 million settlement with Apple, Lenovo

Supermassive black holes found spiraling in at seven percent light speed

Simulation of the pair of supermassive black hole binary system, PG 1302-102. The smaller shines more brightly because it’s farther from the center of mass, and thus closer to the outer disk of gas. This gas accretes onto the black hole, heating up as it falls in, and thus emits more light. The more massive black hole, therefore, is starved of gas and doesn’t glow as brightly. (credit: Zoltan Haiman, Columbia University ) Data from NASA’s Galaxy Evolution Explorer ( GALEX ) and the Hubble Space Telescope has confirmed the presence of a pair of supermassive black holes orbiting each other so closely that they’re moving at relativistic speeds—a significant fraction of the speed of light. Supermassive black holes are expected to come in pairs pretty often. That’s because every galaxy has its own supermassive black hole, and galaxies often merge, bringing the two together. These mergers are very slow processes that distort both galaxies until their stars settle into new orbits (a process known as “violent relaxation”). While this is happening, extremely heavy objects, such as supermassive black holes, will tend to move in toward the center of the new galaxy. The new galaxy would end up with two supermassive black holes, one from each original galaxy, orbiting each other at its core. Objects have been observed which look a lot like supermassive black hole binaries, matching the prediction. These objects have a lot of mass—billions of times the mass of the Sun, as we’d expect from a pair of supermassives—and they’re periodic, meaning the amount of light the object produces rises and falls with a predictable time period. Read 17 remaining paragraphs | Comments

Continue reading here:
Supermassive black holes found spiraling in at seven percent light speed