Tag: user agreement

ColdFusion hack used to steal hosting provider’s customer data

A vulnerability in the ColdFusion Web server platform, reported by Adobe less than a week ago, has apparently been in the wild for almost a month and has allowed the hacking of at least one company website, exposing customer data. Yesterday, it was revealed that the virtual server hosting company Linode had been the victim of a multi-day breach that allowed hackers to gain access to customer records. The breach was made possible by a vulnerability in Adobe’s ColdFusion server platform that could, according to Adobe, “be exploited to impersonate an authenticated user.” A patch had been issued for the vulnerability on April 9  and was rated as priority “2” and “important.” Those ratings placed it at a step down from the most critical, indicating that there were no known exploits at the time the patch was issued but that data was at risk. Adobe credited “an anonymous security researcher,” with discovering the vulnerability. But according to IRC conversation  including one of the alleged hackers of the site, Linode’s site had been compromised for weeks before its discovery. That revelation leaves open the possibility that other ColdFusion sites have been compromised as hackers sought out targets to use the exploit on. Read 5 remaining paragraphs | Comments

Read the original post:
ColdFusion hack used to steal hosting provider’s customer data

“Syrian Electronic Army” hacks NPR publishing system, edits articles

NPR’s Web publishing system and several of the news agency’s Twitter accounts were hacked yesterday by a group supportive of the Syrian government that calls itself the “Syrian Electronic Army.” “Late Monday evening, several stories on the NPR website were defaced with headlines and text that said ‘Syrian Electronic Army Was Here,'” an NPR statement published in a NPR.org news story on the incident said. “Some of these stories were distributed to and appeared on NPR Member Station websites. We have made the necessary corrections to those stories on NPR.org and are continuing to work with our Member Stations. Similar statements were posted on several NPR Twitter accounts. Those Twitter accounts have been addressed. We are closely monitoring the situation.” Sophos’s Naked Security blog published a summary of the hack , including a screenshot of a Google search showing some of the headlines edited by the Syrian Electronic Army: Read 3 remaining paragraphs | Comments

Continue reading here:
“Syrian Electronic Army” hacks NPR publishing system, edits articles

New security protection, fixes for 39 exploitable bugs coming to Java

A dialog box presented by Java when it encounters an application that isn’t signed by a digital certificate. Java.com Oracle plans to release an update for the widely exploited Java browser plugin. The update fixes 39 critical vulnerabilities and introduces changes designed to make it harder to carry out drive-by attacks on end-user computers. The update scheduled for Tuesday comes as the security of Java is reaching near-crisis levels. Throughout the past year, a series of attacks hosted on popular websites has been used to surreptitiously install malware on unwitting users’ machines. The security flaws have been used to infect employees of Facebook and Apple in targeted attacks intended to penetrate those companies. The vulnerabilities have also been exploited to hijack computers of home and business users. More than once, attackers have exploited one previously undocumented bug within days or weeks of patching a previous “zero-day,” as such vulnerabilities are known, creating a string of attacks on the latest version of the widely used plugin. In all, Java 7 Update 21 will fix at least 42 security bugs, Oracle said in a pre-release announcement . The post went on to say that “39 of those vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password.” The advisory didn’t specify or describe the holes that will be patched. Security Exploration, a Poland-based security company that has discovered dozens of “security issues” in Java, has a running list of them here . Read 5 remaining paragraphs | Comments

Follow this link:
New security protection, fixes for 39 exploitable bugs coming to Java

New F-1B rocket engine upgrades Apollo-era design with 1.8M lbs of thrust

NASA has spent a lot of time and money resurrecting the F-1 rocket engine that powered the Saturn V back in the 1960s and 1970s, and Ars recently spent a week at the Marshall Space Flight Center in Huntsville, Alabama, to get the inside scoop on how the effort came to be . But there’s a very practical reason why NASA is putting old rocket parts up on a test stand and firing them off: its latest launch vehicle might be powered by engines that look, sound, and work a whole lot like the legendary F-1. This new launch vehicle, known as the Space Launch System , or SLS, is currently taking shape on NASA drawing boards. However, as is its mandate, NASA won’t be building the rocket itself—it will allow private industry to bid for the rights to build various components. One potential design wrinkle in SLS is that instead of using Space Shuttle-style solid rocket boosters, SLS could instead use liquid-fueled rocket motors, which would make it the United States’ first human-rated rocket in more than 30 years not to use solid-fuel boosters. The contest to suss this out is the Advanced Booster Competition , and one of the companies that has been down-selected as a final competitor is Huntsville-based Dynetics . Dynetics has partnered with Pratt Whitney Rocketdyne (designers of the Saturn V’s F-1 engine, among others) to propose a liquid-fueled booster featuring an engine based heavily on the design of the famous F-1. The booster is tentatively named Pyrios , after one of the fiery horses that pulled the god Apollo’s chariot; the engine is being called the F-1B. Read 34 remaining paragraphs | Comments

More:
New F-1B rocket engine upgrades Apollo-era design with 1.8M lbs of thrust

Huge attack on WordPress sites could spawn never-before-seen super botnet

CloudFlare Security analysts have detected an ongoing attack that uses a huge number of computers from across the Internet to commandeer servers that run the WordPress blogging application. The unknown people behind the highly distributed attack are using more than 90,000 IP addresses to brute-force crack administrative credentials of vulnerable WordPress systems, researchers from at least three Web hosting services reported. At least one company warned that the attackers may be in the process of building a “botnet” of infected computers that’s vastly stronger and more destructive than those available today. That’s because the servers have bandwidth connections that that are typically tens, hundreds, or even thousands of times faster than botnets made of infected machines in homes and small businesses. “These larger machines can cause much more damage in DDoS [distributed denial-of-service] attacks because the servers have large network connections and are capable of generating significant amounts of traffic,” Matthew Prince, CEO of content delivery network CloudFlare, wrote in a blog post describing the attacks. Read 10 remaining paragraphs | Comments

See the original article here:
Huge attack on WordPress sites could spawn never-before-seen super botnet

BlackBerry wants SEC to investigate “false reports” of Z10 returns

Yesterday, brokerage firm Detwiler Fenton claimed that more people were returning BlackBerry Z10s than had bought them at retail in the first place. Today, BlackBerry responded , saying not only that the Detwiler report was incorrect, but that it was going to ask the Securities and Exchange Commission in the US and the Ontario Securities Commission in Canada to review the report. Of the reports, BlackBerry CEO Thorsten Heins said, “Return rate statistics show that we are at or below our forecasts and right in line with the industry. To suggest otherwise is either a gross misreading of the data or a willful manipulation. Such a conclusion is absolutely without basis and BlackBerry will not leave it unchallenged.” The smartphone company also noted that Detwiler refused to make its report or methodology available. How more phones could be returned than were sold isn’t clear. Detwiler Fenton is the same firm that predicted that Microsoft would sell 2-3 million Surface Pro units in the fourth quarter of 2012, despite the fact that Microsoft explicitly said the device wouldn’t ship until three months after the Surface RT’s October launch. Read 2 remaining paragraphs | Comments

More here:
BlackBerry wants SEC to investigate “false reports” of Z10 returns

Meet the nice-guy lawyers who want $1,000 per worker for using scanners

Aurich Lawson / Thinkstock Starting late last year, hundreds of US businesses began to receive demand letters from secretive patent-holding companies with six-letter gibberish names: AdzPro, GosNel, and JitNom. The letters state that using basic office equipment, like scanners that can send files to e-mail, infringes a series of patents owned by MPHJ Technologies. Unless the target companies make payments—which start at around $9,000 for the smallest targeted businesses but go up from there—they could face legal action. In a world of out-there patent claims, MPHJ is one of the most brazen yet. It’s even being talked about in Congress. Rep. Peter DeFazio (D-OR), who has sponsored the anti-troll SHIELD Act, cited the operation as a perfect example of why the system needs reform. After publishing a story on the scanner-trolling scheme , Ars heard from letter recipients and their lawyers from around the country—Idaho and Texas, California and South Dakota. Before the AdzPros and GosNels took over, the patents were owned by an entity called Project Paperless, which threatened dozens of businesses in Virginia and Georgia. Project Paperless ultimately filed two lawsuits, prosecuted by lawyers at Hill, Kertscher, and Wharton, an Atlanta firm with complex connections to the patents. In late 2012, Project Paperless sold the patents to MPHJ Technology Investments. Today, the anonymous owner of MPHJ operates GosNel, AdzPro, JitNom, and at least a dozen other shell companies now targeting small businesses around the country. Read 65 remaining paragraphs | Comments

More:
Meet the nice-guy lawyers who want $1,000 per worker for using scanners

Report: Xbox 360 successor can tolerate only brief Internet interruptions

Kotaku is citing two unnamed sources that it says “have a perfect track record in getting these kinds of things right” to report that Microsoft’s follow-up to the Xbox 360 will need a working Internet connection to start games and apps. And the site goes on to write that the system will only tolerate brief interruptions in that connection while the game or app is being used. “Unless something has changed recently, Durango consumer units must have an active Internet connection to be used,” one source told the site, referring to the internal code name for Microsoft’s next system. “If there isn’t a connection, no games or apps can be started. If the connection is interrupted, then after a period of time—currently three minutes, if I remember correctly—the game/app is suspended and the network troubleshooter started.” Another source said this requirement was still in effect on development hardware as recently as two weeks ago. Information suggesting that the next Microsoft console will need to be online is nothing new; numerous leaks and rumors have pointed in that direction throughout the last year or so. However, this is the first serious suggestion that such connectivity would need to be more or less continuous while a game is being played, rather than just checked once when a game or app is launched. Read 3 remaining paragraphs | Comments

More:
Report: Xbox 360 successor can tolerate only brief Internet interruptions

Apple puts age ratings front and center on app product pages

The old App Store app page layout, left, and new layout, right. Apple has pushed the age ratings for its App Store apps to the top of the product pages in an effort to make buyers, especially parents, more aware of the type of content they’re getting. The age ratings are now directly below the app-maker’s name, and they sit above the user ratings. Apple has faced some disgraces lately with apps that have gained the spotlight only to blindside unexpecting users with adult content. The short-video sharing app Vine was featured as an App Store Editors’ Choice shortly before porn surfaced within the app’s Editors’ Picks ; the image-sharing app 500px was also yanked for its pornographic pictures. Both apps now have a 17+ rating slapped on them. While Apple’s new prominent app ratings won’t solve the unpredictable-user-generated-content problem, they will get parents and guardians to pay more attention to what kinds of apps they are downloading. This change also follows Apple’s addition of an “Offers In-App Purchases” label to app product pages to help account-owning parents anticipate which apps will allow their kids to wantonly bill items within an app—before they get the credit card bill. Read on Ars Technica | Comments

See the article here:
Apple puts age ratings front and center on app product pages