Tag: yorker-vanity

Support scams that plagued Windows users for years now target Mac customers

Enlarge (credit: Malwarebytes) For years, scammers claiming that they’re “calling from Windows” have dialed up Microsoft customers and done their best to trick them into parting with their money or installing malicious wares. Now, the swindlers are turning their sights on Mac users. Researchers at antivirus provider Malwarebytes spotted a Web-based campaign that attempts to trick OS X and iOS users into thinking there’s something wrong with their devices . The ruse starts with a pop-up window that’s designed to look like an official OS notification. “Critical Security Warning!” it says. “Your Device (iPad, iPod, iPhone) is infected with a malicious adward [sic] attack.” It goes on to provide a phone number people can call to receive tech support. The site ara-apple.com is designed to masquerade as https://ara.apple.com/ , Apple’s official remote technical support page. People who are experiencing problems with their Macs can go there to get an official Apple tech support provider to remotely access the person’s computer desktop. Ara-apple provides links to the remote programs the supposed technician will use to log in to targets’ Macs. Read 1 remaining paragraphs | Comments

Read this article:
Support scams that plagued Windows users for years now target Mac customers

Breaking 512-bit RSA with Amazon EC2 is a cinch. So why all the weak keys?

(credit: martinak15 ) The cost and time required to break 512-bit RSA encryption keys has plummeted to an all-time low of just $75 and four hours using a recently published recipe that even computing novices can follow. But despite the ease and low cost, reliance on the weak keys to secure e-mails, secure-shell transactions, and other sensitive communications remains alarmingly high. The technique, which uses Amazon’s EC2 cloud computing service , is described in a paper published last week titled Factoring as a Service . It’s the latest in a 16-year progression of attacks that have grown ever faster and cheaper. When 512-bit RSA keys were first factored in 1999, it took a supercomputer and hundreds of other computers seven months to carry out. Thanks to the edicts of Moore’s Law – which holds that computing power doubles every 18 months or so – the factorization attack required just seven hours and $100 in March, when “FREAK,” a then newly disclosed attack on HTTPS-protected websites with 512-bit keys , came to light. In the seven months since FREAK’s debut, websites have largely jettisoned the 1990s era cipher suite that made them susceptible to the factorization attack. And that was a good thing, since the factorization attack made it easy to obtain the secret key needed to cryptographically impersonate the webserver or to decipher encrypted traffic passing between the server and end users. But e-mail servers, by contrast, remain woefully less protected. According to the authors of last week’s paper, the RSA_EXPORT cipher suite is used by an estimated 30.8 percent of e-mail services using the SMTP protocol , 13 percent of POP3S servers . and 12.6 percent of IMAP-based e-mail services . Read 6 remaining paragraphs | Comments

See more here:
Breaking 512-bit RSA with Amazon EC2 is a cinch. So why all the weak keys?

Marijuana exposure in utero has lifelong consequences

A newborn mouse. (credit: Credit: Wikimedia Commons ) As marijuana is legalized in more states, questions about its safety and the health consequences of cannabis use are becoming mainstream. A new study published in PNAS finds that use of cannabis by pregnant women can have implications for the neural development of her child, and that some of the consequences continue into adulthood, So, like alcohol, another recreational drug that is legal in the US, marijuana is likely best avoided by pregnant women. The most prominent active ingredient in marijuana is a compound known as THC, which interacts with the naturally occurring cannabinoid receptors in the nervous system. Cannabinoid receptors are known to play an important role in the regulation of brain development, and this paper examines the influence of a prenatal THC exposure on the maturation of pathways regulated by these receptors. The study examined prenatal cannabis consumption in mice, with the aim of identifying the mechanisms responsible for cannabis-related changes in brain function. During the study, pregnant mice were exposed to daily injections of THC or injections of a control liquid. Then the offspring were run through a battery of behavioral tests. The animals’ brains were also examined closely using immunoflouresence and confocal microscopy. Embryonic brain tissue from some litters was also collected and checked for irregularities. Read 5 remaining paragraphs | Comments

View original post here:
Marijuana exposure in utero has lifelong consequences

Android 6.0 re-implements mandatory device encryption for new devices

(credit: Google) Shortly after the announcement of iOS 8 in 2014, Google made headlines by saying that it would make full-device encryption mandatory for new Android devices running version 5.0. It then made more headlines several months later when we discovered that the company backed down , “strongly recommending” that Android device makers enable encryption but stopping short of actually requiring it. Now Google has published an updated version of the Android Compatibility Definition Document ( PDF ) for Android 6.0, and it looks like mandatory encryption is back with a couple of exceptions. New devices that come with Marshmallow and have AES crypto performance above 50MiB-per-second need to support encryption of the private user data partition (/data) and the public data partition (/sdcard). The relevant portion of the document, emphasis ours: Read 2 remaining paragraphs | Comments

Originally posted here:
Android 6.0 re-implements mandatory device encryption for new devices

Scientists grow functional kidney organoid from stem cells

A drawing shows the complex structure of a kidney. (credit: Wikimedia commons ) There are many diseases that attack specific organs, landing patients on a transplant list. Unfortunately, our bodies have markers that identify an organ as “self,” which makes it difficult to find an organ match. Many individuals die waiting for an organ transplant because a match can’t be found. Research on stem cells—a type of cell that is able to transform into nearly any cell type—has raised hopes of treating organ failure. Researchers envision using these cells to grow fully functional organs. A functional organ is similar to a machine. Organs contain many interacting parts that must be positioned in a specific configuration to work properly. Getting all the right cell types in the appropriate locations is a real challenge. Recently, a team of scientists has met that challenge by using stem cells to grow a tissue, termed an organoid, that resembles a developing kidney. Read 8 remaining paragraphs | Comments

Continue reading here:
Scientists grow functional kidney organoid from stem cells

Cage against the EMP: New composite cases protect against the electro-apocalypse

A Faraday Cases travel case, configured to keep communications gear safe in transit from unfriendly electromagnetism. 2 more images in gallery WASHINGTON, DC—A small company from Utah has developed a composite material that combines carbon fibers with a nickel coating. The result is an extremely lightweight electric-conducting material with the properties of plastic. And now that material is being used to create cases and computer enclosures that are essentially lightweight Faraday cages—containing electromagnetic radiation from digital devices and shielding them from electronic eavesdropping or electromagnetic pulse attacks. Ars got a brief hands-on with some of the materials at the Association of the United States Army expo this week. The company, Conductive Composites , is now selling cases built with the Nickel Chemical Vapor Deposition (NiCVD) composite material through its Faraday Cases division . The cases range in size from suitcase-sized units for carrying smaller digital devices to wheeled portable enclosures that can house servers—providing what is essentially an EMP-shielded portable data center. The cases and enclosures are being marketed not just to the military but to consumers, corporations, and first responders as well. The materials used in Faraday Cases can also be used to create ultra-lightweight antennas, satellite communications reflector dishes, and hundreds of other things that currently need to be made with conductive metal. And they could be a boon to anyone trying to prevent electronic eavesdropping—be it through active wireless bugs, radio retroreflectors used by nation-state intelligence agencies, or passive surveillance through anything from Wi-FI hacking to electromagnetic signals leaking from computer cables and monitors. And in some cases, they could make it possible to create the kind of secure spaces used by government agencies to prevent eavesdropping nearly anywhere. Read 9 remaining paragraphs | Comments

View article:
Cage against the EMP: New composite cases protect against the electro-apocalypse

University of Cambridge study finds 87% of Android devices are insecure

The study’s estimate of the proportion of known “insecure,” “maybe secure” and “secure” devices over time. (credit: androidvulnerabilities.org ) It’s easy to see that the Android ecosystem currently has a rather lax policy toward security, but a recent study from the University of Cambridge put some hard numbers to Android’s security failings. The conclusion finds that “on average 87.7% of Android devices are exposed to at least one of 11 known critical vulnerabilities.” Data for the study was collected through the group’s ” Device Analyzer ” app, which has been available for free on the Play Store since May 2011. After the participants opted into the survey, the University says it collected daily Android version and build number information from over 20,400 devices. The study then compared this version information against 13 critical vulnerabilities (including the Stagefright vulnerabilities ) dating back to 2010. Each individual device was then labeled “secure” or “insecure” based on whether or not its OS version was patched against these vulnerabilities, or placed in a special “maybe secure” category if it could have gotten a specialized, backported fix. As for why so many Android devices are insecure, the study found that most of the blame sits with OEMs. The group states that “the bottleneck for the delivery of updates in the Android ecosystem rests with the manufacturers, who fail to provide updates to fix critical vulnerabilities.” Along with the study, the University of Cambridge is launching ” AndroidVulnerabilities.org ,” a site that houses this data and grades OEMs based on their security record. The group came up with a 1-10 security rating for OEMs that it calls the “FUM” score. This algorithm takes into account the number of days a proportion of running devices has no known vulnerabilities ( F ree), the proportion of devices that run the latest version of Android ( U pdate), and the mean number of vulnerabilities not fixed on any device the company sells ( M ean). The study found that Google’s Nexus devices were the most secure out there, with a FUM score of 5.2 out of 10. Surprisingly, LG was next with 4.0, followed by Motorola, Samsung, Sony, and HTC, respectively. Read 3 remaining paragraphs | Comments

Read the article:
University of Cambridge study finds 87% of Android devices are insecure

How Soviets used IBM Selectric keyloggers to spy on US diplomats

(credit: Etan J. Tal ) A National Security Agency memo that recently resurfaced a few years after it was first published contains a detailed analysis of what very possibly was the world’s first keylogger—a 1970s bug that Soviet spies implanted in US diplomats’ IBM Selectric typewriters to monitor classified letters and memos. The electromechanical implants were nothing short of an engineering marvel. The highly miniaturized series of circuits were stuffed into a metal bar that ran the length of the typewriter, making them invisible to the naked eye. The implant, which could only be seen using X-ray equipment, recorded the precise location of the little ball Selectric typewriters used to imprint a character on paper. With the exception of spaces, tabs, hyphens, and backspaces, the tiny devices had the ability to record every key press and transmit it back to Soviet spies in real time. A “lucrative source of information” The Soviet implants were discovered through the painstaking analysis of more than 10 tons’ worth of equipment seized from US embassies and consulates and shipped back to the US. The implants were ultimately found inside 16 typewriters used from 1976 to 1984 at the US embassy in Moscow and the US consulate in Leningrad. The bugs went undetected for the entire eight-year span and only came to light following a tip from a US ally whose own embassy was the target of a similar eavesdropping operation. Read 7 remaining paragraphs | Comments

Read the original post:
How Soviets used IBM Selectric keyloggers to spy on US diplomats

Webflow’s “first visual CMS” is like WordPress mixed with Photoshop

A demo video showing off Webflow CMS. Web design tools like Webflow have done a lot to thin the line between designers and developers. Now, however, the birthed-by-Y-Combinator startup wants to take it further with what it describes as the world’s first visual content management system (CMS). There’s not much to it right now. In a nutshell, Webflow CMS is a barebones WordPress installation jammed into a Photoshop-like interface. The idea here is to provide a way to create “completely custom websites powered by dynamic content” without any knowledge of HTML, CSS, PHP, or databases. And to an extent, it works. The Webflow CMS allows users to create or use pre-existing “Collections”—templates for dynamic content types. From there, you can then determine the kind of fields associated with the Collection, such as whether they’re mandatory to be completed, if they’re to be linked to another Collection, and what kind of minimum word counts are to be expected. These criteria are universal for any instance of the Collection. All Blog Posts, for example, will draw from the parent Blog Posts Collection. Read 4 remaining paragraphs | Comments

Continue reading here:
Webflow’s “first visual CMS” is like WordPress mixed with Photoshop

Patreon was warned of serious website flaw 5 days before it was hacked

Enlarge / Results of a Shodan search performed on September 11 made it clear Patreon was vulnerable to code-execution attacks. (credit: Detectify) Five days before Patreon.com officials said their donations website was plundered by hackers, researchers at a third-party security firm notified them that a serious programming error could lead to disastrous results. The researchers now believe the vulnerability was the entry point for attackers who went on to publish almost 15 gigabytes’ worth of source code, user password data, and private messages . The error was nothing short of facepalm material. Patreon developers allowed a Web application tool known as the Werkzeug utility library to run on a public-facing subdomain. Specifically, according to researchers at Swedish security firm Detectify , one or more of Patreon’s live Web apps on zach.patreon.com was running Werkzeug debugging functions. A simple query on the Shodan search service brought the goof to the attention of Detectify researchers, who in turn notified Patreon officials on September 23. Adding to their concern, the same Shodan search shows thousands of other websites making the same game-over mistake. Remote code execution by design The reason for the alarm was clear. The Werkzeug debugger allows visitors to execute code of their choice from within the browser. Werkzeug developers have long been clear about this capability and the massive risks that stem from using it in production environments . But in case anyone missed the warning, an independent blogger called attention to the threat last December. Read 6 remaining paragraphs | Comments

Follow this link:
Patreon was warned of serious website flaw 5 days before it was hacked