April « 2014 « Skilled Bail Bonds Process | Orange County Fl Bail Bond Category : Orlando Bail Bondsman , Orlando Fl Bail Bonds CAPTCHAs Are Becoming Security Theater CAPTCHAs are a time-worn way for humans to tell computers that we are human. They are those little boxes filled with distorted text that we’ve been told humans can decipher, but computers—the bad guys’ computers—cannot. So, Watson-be-damned, we enter the letters and gain access to whatever is behind the veil, leaving the bad bots steaming outside the pearly, CAPTCHA’d gates. As Google’s ReCAPTCHA website puts it: “Tough on bots, easy on humans.” It is a satisfying display of human superiority built into the daily experience of the web. And, BONUS, you’re often helping do optical character recognition on old books at the same time. Take that, Machines, you don’t even have any books. But then along comes Google today noting, in a showily short and breezy blog post, that their machines can beat ReCAPTCHAs 99% of the time.

“Turns out that this new algorithm can also be used to read CAPTCHA puzzles—we found that it can decipher the hardest distorted text puzzles from reCAPTCHA with over 99 percent accuracy,” writes Google product manager Vinay Shet. “This shows that the act of typing in the answer to a distorted image should not be the only factor when it comes to determining a human versus a machine.” But that’s not even the most galling thing. That’s reserved for the next paragraph. “Last year, we announced that we’ve significantly reduced our dependence on text distortions as the main differentiator between human and machine,” Shet continues, “and instead perform advanced risk analysis.”So, we’ve been proudly typing away the whole time, proving we were human, and Google knew that all along. In an earlier post, Shet described their process in general terms: Google has begun “actively considering the user’s entire engagement with the CAPTCHA—before, during and after they interact with it.

That means that today the distorted letters serve less as a test of humanity and more as a medium of engagement to elicit a broad range of cues that characterize humans and bots.” Now, we go on typing into the box, but our revolved visual systems—some of the most sophisticated in the animal kingdom—are no longer all that necessary. What we once did to assure Google that we were still human has become security theater. The only audience that we need to perform our humanity for is ourselves. SOURCE : theatlantic.com/technology/archive/2014/04/captchas-are-becoming-security-theater/360786/ Category : Orange County Fl Bail bonds , Orlando Bail Not Legal Immigrants Concerning Randy Camacho’s comments that wee should eliminate word “illegal” from our vocabulary (Plugged In, Viewpoints, Sunday). Ask Arizona citizens in the southernmost part of the state how they see “not” legal immigration affecting them. Ask them if they have had their property littered, damaged and robbed by these “not” legal people looking for a path to bypass the “legal” immigration system.

Ask them if their real-estate property values are decreasing because of this constant onslaught of dreamers hoping for a better life or drug smugglers working to deliver another load. Ask them if they think we should pay for these “not” legal people who come here to avail themselves of our free goods and services at the expense of the American taxpayers. And ask them if they live their lives in fear from these “not” legal criminals. If the words “illegal immigrant” indicates something offensive, then use “not” legal immigrant to clearly define who they are.Also, let’s support laws that stop all “not” legal immigration activity at the border to maintain our sovereign state in the United States of America. SOURCE : azcentral.com/story/opinion/letters/2014/04/14/just-call-them-not-legal-immigrants/7721915/ Category : Orange County Fl Bailbonds , Orlando Bail Need a National Change Your Passwords Day Heartbleed, the major flaw that left passwords and other user information vulnerable to hackers this week, wasn’t the first security flaw to affect the Internet. And it won’t be the last. Security failures, hacks, leaks, and vulnerability discoveries are inevitable.

As is the typical reaction: When news of a hack surfaces, we worry, and then some of us spring to action, generally changing passwords on affected accounts — especially if the affected sites force us to. But you should change your passwords regularly, even if you aren’t facing down a flaw like Heartbleed. What we need is a National Change Your Passwords Day so you don’t forget. Here’s why. Known unknowns and unknown unknowns – One thing Heartbleed has shown us is that there are hacks and attacks, which sometimes we hear about and react to, and then there are the more worrisome discoveries of security flaws, which are worse. Heartbleed was a discovery, not an attack. A team of security engineers discovered a flaw in a version of common software, OpenSSL, that many major sites (and many more minor ones) use to protect and encrypt users’ data. This flaw had existed for over two years; it was only now discovered. The discovery of this flaw doesn’t necessarily mean that bad guys have been exploiting it, and it doesn’t point to any specific attacks.

Rather, it means that if anyone else (like, say,the NSA) also discovered this bug between the time when it was first included in the software, and when the Heartbleed discovery team told the world about it, they could have been using it to access or attack your data. There is no way to completely protect yourself from threats you don’t know about. But you can and should take precautions. The most obvious precaution: Limiting your exposure to individual hacks by making sure you have a unique and strong password for each different online account. I can’t stress enough how important it is to have different passwords for different accounts. It’s more important than having strong (unguessable) passwords, in fact. The only reasonable way to manage all these different passwords is with a password manager. I wrote a primer on these apps back in February. Since changing a lot of passwords is a colossal pain the neck (and I mean massively inconvenient), even with a good password manager to help you, perhaps it’d be best if you set aside a big chunk of time to do it. Like, a day. Maybe, in fact, a day off from work. A paid day off from work. Hey, I can dream.

And keeping people (more) secure will actually save the country money, at least compared to the potential economic catastrophe of a real, pervasive, and exploited breakdown in Internet security. Another thing you might want to do is enable two-factor authentication (also called two-step authentication) on sites that support it, like Google and Dropbox. Two-factor authentication makes it much more difficult to sign on to an account unless you have the account owner’s smartphone with you, on which a second, always-changing password (the second factor or step) is displayed. We’ll have more on two-factor authentication in a future article. So when is this new National Change Your Passwords Day? I’d propose we use the transition from Standard to Daylight time as the day for this, since more clocks are setting themselves these days and we have all that extra time to mind our technology. In fact, we should do password resets more than once a year, so let’s make it a twice-yearly holiday and use the transition from Daylight to Standard, too. So what’s been stolen? Maybe nothing. Maybe a lot – So here’s the bad news: Even regularly changing your passwords won’t completely protect you from unknown theft of your personal data.

It protects you a bit more, but not completely. It can take just microseconds for a hacker’s system to exploit a security flaw on a service you use. But the more often you change your locks, the less likely a stolen key will to work in them. If you’ve been hacked, and then you change your password, you’re protecting yourself against future intrusion into your account. That’s very good and necessary. But the digital goods you want to protect may already have been stolen. In particular, your credit card numbers are vulnerable, if you save those numbers in online accounts. You think it’s inconvenient to change passwords? Try changing credit card numbers. You can’t just call your issuers and ask for new cards just to be safe. You can report your card stolen, in which case they’ll immediately deactivate your existing card send you a new one. That might take a few days, and of course any automatic payments set up on that card will fail the next time they come due. And let’s not talk about trying to change other financially-relevant data, like a social security number.

(Although if an online or commerce site other than a financial institution asks for a social security number, you would be wise to wonder why.) The good news when it comes to Heartbleed (yes, there is some), is that, as far as we know, no actual banks or brokerages used the OpenSSL software that Heartbleed attacked. A bit more on password managers – Once more, with feeling: A password manager can improve your online security while also removing a lot of the hassle of keeping different passwords. However, password managers themselves are protected by passwords, which means they could potentially become vulnerable to a Heartbleed-like vulnerability. The good news (again!) is that of the three password managers I recommend — Lastpass, 1Password, and Dashlane — none are directly vulnerable to the Heartbleed flaw. I say, “directly” because Lastpass and 1Password both have some small exposure. Lastpass uses OpenSSL to transmit data, but it encrypts the data before the OpenSSL software sees it, so Lastpass claims they’re not vulnerable to Heartblleed attacks. 1Password has a slight possibility of a flaw if you use its synchronizing service, 1PasswordAnywhere, with Dropbox to keep your passwords in sync across devices.

If you’re in that camp, there’s a small chance that a possible Heartbleed vulnerability on Dropbox could allow an attacker to replace your 1Password sync file with a malicious version of your file, causing havoc across your 1Password account (while not actually stealing your passwords). So if you are using one of these password managers, you might want to read their blog posts about Heartbleed. Here they are: Lastpass | 1Password | Dashlane. The main takeway: As part of the Hearbleed password panic, it’s a good idea to change your most important passwords now, starting with your password manager, if you have one. And then change it again, perhaps the next time National Change Your Passwords Day rolls around and you’re changing all your other critical passwords. And if you don’t have a password manager, get one now.

SOURCE : yahoo.com/tech/we-need-a-national-change-your-passwords-day-82301322882.html Category : Orange County Fl Bail Bond , Orange County Fl Bail Bondsman Netherlands – No Longer Download Copyrighted Movies & Music The European Court of Justice has ruled that citizens in the Netherlands can no longer download copyrighted movies and music without paying for them and without breaking the law. The court ruled that the current system of a privacy levy is unlawful. Downloading pirated films and music is popular the world over, and in the Netherlands an estimated one-third of the population is at it. Unlike most other countries, in the Netherlands it’s not a criminal offense. This is because the Dutch introduced a system where consumers pay a “piracy levy” to compensate rights holders when they buy writeable media with storage capacity, such as hard drives and smartphones. Until Thursday’s ruling, anyone buying a smartphone, tablet, computer or laptop pays a 5 euro charge to cover the cost of home copying. But in a landmark ruling in a case brought by several electronic stores and manufactures, the European Court of Justice has said the system is illegal. The electronics companies had successfully argued that the levy made their products more expensive.

The judgment said that the levy puts copyright holders at an unfair advantage as well as being a threat to the internal Dutch market. “The objective of proper support for the dissemination of culture may not be achieved by sacrificing strict protection of copyright or by tolerating illegal forms of distribution of counterfeited or pirated works,” it read. The court concluded that the Dutch levy system encourages the distribution of counterfeit and pirated works. The court also concluded that decriminalizing file sharing punished those who brought their films and music from authorized retailers as they are double paying on the devices and media they record onto. The Dutch government has confirmed the court’s ruling and has posted a statement on its website saying that downloading copyrighted material for personal use is banned with immediate effect. However, copyright holders may be worse off as it will result in millions of euros of lost revenue through the piracy levy, which would doubtless be very hard to match through legal sales in movies and music, which are in decline in many places in the world. From now in it will only be legal to copy material onto a hard drive that has been bought legally. The judgment is likely to affect other European countries where downloading copyrighted works in also permitted like Switzerland.

SOURCE : rt.com/news/copyright-pirated-films-music-724/ Orange County FL Bail Bond Walt Disney Parks and Resorts today denied allegations in a lawsuit filed by families of children with developmental disorders that the company has caused them suffering and violated the American With Disabilities Act. The 57-count complaint (read it here), filed last week, seeks damages, injunctive relief, and declaratory relief for violations of the ADA and the Unruh Civil Rights Act. ”Disney Parks have an unwavering commitment to providing an inclusive and accessible environment for all our guests,” a Disney Parks and Resorts spokesperson said today. “We fully comply with all ADA requirements and believe that the legal claims are without merit.” The scathing legal action filed by 16 children and young adults with autism and other developmental disorders and their guardians and parents contends that Disney’s recently implemented Disability Access Service violates federal and state law and is completely unsuited to the needs of individuals with such special needs. Disney disagrees. “Our Disability Access Service is designed for guests who, due to certain disabilities, cannot tolerate extended wait times at attractions.

In circumstances where the service might not meet guests needs, we work individually with guests to ensure we are able to accommodate them,” said the company in a statement. The 176-page complaint also alleges that, at the same time Disney moved to the DAS system last October, the Parks and Resorts division created a secret ”Magic List” program that could actually help solve a lot of their concerns. “The Magic List is a secret list of persons to whom Disney will automatically extend, without the stigma of a ‘Disability’ card, and without a mandatory photograph, and without the newly-ingrained disrespect of Disney employees, five immediate-entry, no-appointment ride passes,” says the April 3 filing in federal court. “The Magic List does not perfectly accommodate the special needs of all persons with cognitive impairments, but it is considerably better than the recklessly inadequate DAS card,” it adds. “Disney is withholding the existence of the ‘Magic List’ from the broader community of families in which someone has a cognitive impairment.

By doing so, Disney continues to deter families from visiting the Parks or making plans to do so.” While Disney has a Make-A-Wish Foundation program that provides front-of-the-line access among other privileges, the “Magic List” the plaintiffs allege seems to be something very different. A WDPR spokesperson denied to Deadline any knowledge of the so-called Magic List. Introduced last fall as a replacement for the longstanding Guest Assistance Card program in an effort to curb scams — such as well-heeled patrons hiring disabled individuals to travel around Disneyland and other parks with them so they could get on rides without waiting — the new system now results in long waits for rides and often results in “meltdown behaviors,” the plaintiffs claim. The complaint also says that once-helpful staff is now inadequate and “robotic” in dealing with such disorders, resulting in various cases of breach of contract and emotional distress.

“Disney’s knowledge is so extensive, and Disney’s new Disability Access Service is so obviously discriminatory and so outrageously contrary to Disney’s own knowledge of such guests’ special needs, that it is inconceivable that the Disability Access Service’s discriminatory impact upon Plaintiffs is an accident,” says the filing from lawyers Andy Dogali of Tampa, FL and Eugene Feldman of Hermosa Beach, CA. It was different at Disney’s six stateside parks and resorts before the change, plaintiffs and their families say. “The Plaintiff parents and guardians uniformly acknowledge that, prior to about October 9, 2013, taking their child to the Disney Parks was one of the few experiences, if not the only experience, which would bring obvious joy to their disabled child for many hours in a row, a notion very uncommon outside Disney’s magical worlds,” says the complaint.

“Prior to October of 2013, Disney’s system for accommodating disabled persons’ special needs was universally enjoyed and appreciated by the community of persons touched by cognitive impairments.” SOURCE : deadline.com/2014/04/disney-parks-lawsuit-autism/ Category : Bail In Orlando , Bail In Orlando Fl HeartBleed Bug Logo The discovery of a significant flaw in software that was supposed to provide extra protection for thousands of websites has thrown the tech world into chaos as experts scrambled to understand the scope of the vulnerability. On Tuesday, Tumblr, which is owned by Yahoo, became the largest website to disclose that it had been hit by the “Heartbleed Bug” and urged users to change not just the password for its site but for all others as well. But signaling just how much uncertainty and confusion surrounds the glitch, security experts warned that such a gesture might actually be useless because if a site has not fixed the problem hackers could just as easily steal the new password. Although security analysts wouldn’t go as far as telling users to stay off the Internet completely, they said users should avoid doing anything sensitive like online banking.

If it’s necessary to go online, check to see whether a service has said whether they are affected or whether they have fixed the problem. “The scope of this is immense,” said Kevin Bocek, vice president of security strategy and threat intelligence for Venafi, a Salt Lake City cybersecurity company. “And the consequences are still scary. I’ve talked about this like a ‘Mad Max’ moment. It’s a bit of anarchy right now. Because we don’t know right now who has the keys and certificates on the Internet right now.” “Heartbleed Bug” is a vulnerability in something called OpenSSL, a technology used to provide encryption of an estimated 66% of all servers on the public Internet. OpenSSL is an open source code that is developed and maintained by a community of developers, rather than by a single company. While such jargon is unfamiliar to average users, most people online have likely seen the green padlock icon in the address bar of their browser, followed by “https” that indicates that the OpenSSL added security has been enabled.

The vulnerability was discovered separately last week by Neel Mehta, a security researcher at Google, and a team of security engineers at Codenomicon, a security website that has since created a website with information about Heartbleed. “Heartbleed is like finding a faulty car part used in nearly every make and model, but you can’t recall the Internet and all the data you put out on it,” said Jonathan Sander, vice president of research and technology for Stealthbits Technologies, a cybersecurity firm in Hawthorne, NJ. It appears the bug was introduced into OpenSSL by a simple programming mistake that then got pushed out as websites around the world updated the version of OpenSSL they were running. After the discovery last week, news spread quickly around the Web on Tuesday as the implications became clearer. As Tumblr made its announcement, security experts found numerous “exploits” or simple pieces of software widely available online that any hacker could grab and use to attack sites left vulnerable by Heartbleed. By running such exploits, a hacker could in just a few seconds download countless emails, passwords, user IDs and much other personal information. “It’s a very simple script,” said Chris Eng, vice president of research at application security testing firm Veracode.

“And there’s still a lot of websites out there that are vulnerable.” An updated version of OpenSSL has been issued, and sites can use that to fix the bug. In addition to updating OpenSSL, sites will need to update many pieces of their security protocols known as keys and certificates that help them confirm the identity of users. But Internet users are now facing a dilemma: How do they know they can trust a site? Because hackers may have gotten so much personal and website security information, experts are worried they can use that to create fake copies or “spoofs” of real sites that will induce users to disclose even more information.”Avoid things like online banking and avoid sensitive sites if you’re not sure,” said Andrew Storms, director of DevOps at CloudPassage. “Some people will see it as overkill. But I think that’s the simplest guidance. If you can hold off doing something online for a couple days, then you should.” SOURCE : latimes.com/business/la-fi-web-vulnerability-20140409,0,3935723.story#ixzz2yMRNLQBj Bail Bondsman In Orlando Fl Another former Georgia ethics staffer sends word she is planning a lawsuit against the ethics commission.

Former staffer Elisabeth Murray-Obertein plans to file her own lawsuit against the agency, according to her attorney, Cheryl Legare. The news comes days after a jury sided with Stacey Kalberman, the commission’s former director, in a lawsuit claiming she was forced out for too aggressively investigating a complaint stemming from Gov. Nathan Deal’s 2010 campaign. It would be the fourth whistle-blower case filed against the embattled agency, and an unwelcome development for a governor facing re-election against opponents who have taken up ethics as a mantra. Deal on Monday abandoned his attempts to distance himself from the agency and instead called for a “comprehensive” overhaul. Former staffers Sherilyn Streicker and John Hair have filed similar lawsuits that are now winding their way through the courts. Neither is on the trial calendar yet, though, and they may not make it that far. As noted earlier, several jurors polled after the Kalberman case openly questioned why state attorneys didn’t settle before bringing to trial. Murray-Obertein’s case could prove more complicated than some of the others.

She was the commission’s top lawyer and, in sworn testimony, accused director Holly LaBerge of bragging that Deal “owes” for making the most serious complaints against him go away. SOURCE : politics.blog.ajc.com/2014/04/08/another-lawsuit-from-ex-ethics-staffer-is-in-the-works/ Cyberwars: The Heartbleed Bug and Web Security – Stories by Williams 1,507 Words Cyberwars: The Heartbleed Bug and Web Security A little over two years ago, a tiny piece of code was introduced to the internet that contained a bug. This bug was known as Heartbleed, and in the two years it has taken for the world to recognize its existence, it has caused quite a few headaches. In addition to allowing cybercriminals to steal passwords and usernames from Yahoo, it has also allowed people to steal from online bank accounts, infiltrate governments institutions (such as Revenue Canada), and generally undermine confidence in the internet. What’s more, in an age of cyberwarfare and domestic surveillance, its appearance would give conspiracy theorists a field day.

And since it was first disclosed a month to the day ago, some rather interesting theories as to how the NSA and China have been exploiting this to spy on people have surfaced. But more on that later. First off, some explanation as to what Heartbleed is, where it came from, and how people can protect themselves from it, seems in order. First off, Heartbleed is not a virus or a type of malware in the traditional sense, though it can be exploited by malware and cybercriminals to achieve similar results. Basically, it is a security bug or programming error in popular versions of OpenSSL, a software code that encrypts and protects the privacy of your password, banking information and any other sensitive data you provide in the course of checking your email or doing a little online banking. Though it was only made public a month ago, the origins of the bug go back just over two years – to New Year’s Eve 2011, to be exact. It was at this time that Stephen Henson, one of the collaborators on the OpenSSL Project, received the code from Robin Seggelmann – a respected academic who’s an expert in internet protocols.

Henson reviewed the code – an update for the OpenSSL internet security protocol — and by the time he and his colleagues were ringing in the New Year, he had added it to a software repository used by sites across the web. What’s interesting about the bug, which is named for the “heartbeat” part of the code that it affects, is that it is not a virus or piece of malware in the traditional sense. What it does is allow people the ability to read the memory of systems that are protected by the bug-affected code, which accounts for two-thirds of the internet. That way, cybercriminals can get the keys they need to decode and read the encrypted data they want. The bug was independently discovered recently by Codenomicon – a Finnish web security firm – and Google Security researcher Neel Mehta. Since information about its discovery was disclosed on April 7th, 2014, The official name for the vulnerability is CVE-2014-0160.it is estimated that some 17 percent (around half a million) of the Internet’s secure web servers that were certified by trusted authorities have been made vulnerable. Several institutions have also come forward in that time to declare that they were subject to attack.

For instance, The Canada Revenue Agency that they were accessed through the exploit of the bug during a 6-hour period on April 8th and reported the theft of Social Insurance Numbers belonging to 900 taxpayers. When the attack was discovered, the agency shut down its web site and extended the taxpayer filing deadline from April 30 to May 5. The agency also said it would provide anyone affected with credit protection services at no cost, and it appears that the guilty parties were apprehended. This was announced on April 16, when the RCMP claimed that they had charged an engineering student in relation to the theft with “unauthorized use of a computer” and “mischief in relation to data”. In another incident, the UK parenting site Mumsnet had several user accounts hijacked, and its CEO was impersonated. Another consequence of the bug is the impetus it has given to conspiracy theorists who believe it may be part of a government-sanctioned ploy. Given recent revelations about the NSA’s extensive efforts to eavesdrop on internet activity and engage in cyberwarfare, this is hardly a surprise.

Nor would it be the first time, as anyone who recalls the case made for the NIST SP800-90 Dual Ec Prng program – a pseudorandom number generator is used extensively in cryptography – acting as a “backdoor” for the NSA to exploit . In that, and this latest bout of speculation, it is believed that the vulnerability in the encryption itself may have been intentionally created to allow spy agencies to steal the private keys that vulnerable web sites use to encrypt your traffic to them. And cracking SSL to decrypt internet traffic has long been on the NSA’s wish list. Last September, the Guardian reported that the NSA and Britain’s GCHQ had “successfully cracked” much of the online encryption we rely on to secure email and other sensitive transactions and data. According to documents the paper obtained from Snowden, GCHQ had specifically been working to develop ways into the encrypted traffic of Google, Yahoo, Facebook, and Hotmail to decrypt traffic in near-real time; and in 2010, there was documentation that suggested that they might have succeeded. Although this was two years before the Heartbleed vulnerability existed, it does serve to highlight the agency’s efforts to get at encrypted traffic.

For some time now, security experts have speculated about whether the NSA cracked SSL communications; and if so, how the agency might have accomplished the feat. But now, the existence of Heartbleed raises the possibility that in some cases, the NSA might not have needed to crack SSL at all. Instead, it’s possible the agency simply used the vulnerability to obtain the private keys of web-based companies to decrypt their traffic. Though security vulnerabilities come and go, this one is deemed catastrophic because it’s at the core of SSL, the encryption protocol trusted by so many to protect their data. And beyond abuse by government sources, the bug is also worrisome because it could possibly be used by hackers to steal usernames and passwords for sensitive services like banking, ecommerce, and email. In short, it empowers individual troublemakers everywhere by ensuring that the locks on our information can be exploited by anyone who knows how to do it.

Matt Blaze, a cryptographer and computer security professor at the University of Pennsylvania, claims that “It really is the worst and most widespread vulnerability in SSL that has come out.” The Electronic Frontier Foundation, Ars Technica, and Bruce Schneier all deemed the Heartbleed bug “catastrophic”, and Forbes cybersecurity columnist Joseph Steinberg event went as far as to say that: Some might argue that [Heartbleed] is the worst vulnerability found (at least in terms of its potential impact) since commercial traffic began to flow on the Internet. Regardless, Heartbleed does point to a much larger problem with the design of the internet. Some of its most important pieces are controlled by just a handful of people, many of whom aren’t paid well — or aren’t paid at all. In short, Heartbleed has shown that more oversight is needed to protect the internet’s underlying infrastructure. And the sad truth is that open source software — which underpins vast swathes of the net — has a serious sustainability problem. Another problem is money, in that important projects just aren’t getting enough of it.

Whereas well-known projects such as Linux, Mozilla, and the Apache web server enjoy hundreds of millions of dollars in annual funding, projects like the OpenSSL Software Foundation – which are forced to raise money for the project’s software development – have never raised more than $1 million in a year. To top it all off, there are issues when it comes to the open source ecosystem itself. Typically, projects start when developers need to fix a particular problem; and when they open source their solution, it’s instantly available to everyone. If the problem they address is common, the software can become wildly popular overnight. As a result, some projects never get the full attention from developers they deserve. Steve Marquess, one of the OpenSSL foundation’s partners, believes that part of the problem is that whereas people can see and touch their web browsers and Linux, they are out of touch with the cryptographic library. In the end, the only real solutions is in informing the public. Since internet security affects us all, and the processes by which we secure our information is entrusted to too few hands, then the immediate solution is to widen the scope of inquiry and involvement.

It also wouldn’t hurt to commit additional resources to the process of monitoring and securing the web, thereby ensuring that spy agencies and private individuals are not exercising too much or control over it, or able to do clandestine things with it. In the meantime, the researchers from Codenomicon have set up a website with more detailed information. Click here to access it and see what you can do to protect yourself. SSL | LIVE HACKING LIVE HACKING March 19, 2015 by Ethical Hacker ( LiveHacking.Com ) – The OpenSSL Project announced on March 16th that it would make a new release of its OpenSSL suite to fix a number security defects. As promised the project published three new versions today, OpenSSL versions 1.0.2a, 1.0.1m, 1.0.0r and 0.9.8zf. The highest severity defect fixed by these releases is classified as High. Before looking at the defects which have been fixed, it is worth noting that the project has reclassified its advisory about the FREAK vulnerability from Low to High.

It was previously classified as Low severity because it was originally thought that server RSA export ciphersuite support was rare: a client was only vulnerable to a MITM attack against a server which supports an RSA export ciphersuite. Recent studies have shown that RSA export ciphersuites support is far more common. The new security advisory lists only one High severity fix, for CVE-2015-0291 – ClientHello sigalgs DoS. If a client connects to an OpenSSL 1.0.2 server and renegotiates with an invalid signature algorithms extension a NULL pointer dereference will occur. This can be exploited in a DoS attack against the server. This issue affects OpenSSL version 1.0.2. The rest of the bug fixes are rated as Moderate or Low: Multiblock corrupted pointer (CVE-2015-0290) – Severity: Moderate – OpenSSL 1.0.2 introduced the “multiblock” performance improvement. This feature only applies on 64 bit x86 architecture platforms that support AES NI instructions. A defect in the implementation of “multiblock” can cause OpenSSL’s internal write buffer to become incorrectly set to NULL when using non-blocking IO.

Typically, when the user application is using a socket BIO for writing, this will only result in a failed connection. However if some other BIO is used then it is likely that a segmentation fault will be triggered, thus enabling a potential DoS attack. Segmentation fault in DTLSv1_listen (CVE-2015-0207) – Severity: Moderate – The DTLSv1_listen function is intended to be stateless and processes the initial ClientHello from many peers. It is common for user code to loop over the call to DTLSv1_listen until a valid ClientHello is received with an associated cookie. A defect in the implementation of DTLSv1_listen means that state is preserved in the SSL object from one invocation to the next that can lead to a segmentation fault. Errors processing the initial ClientHello can trigger this scenario. An example of such an error could be that a DTLS1.0 only client is attempting to connect to a DTLS1.2 only server.

Segmentation fault in ASN1_TYPE_cmp (CVE-2015-0286) – Severity: Moderate – The function ASN1_TYPE_cmp will crash with an invalid read if an attempt is made to compare ASN.1 boolean types. Since ASN1_TYPE_cmp is used to check certificate signature algorithm consistency this can be used to crash any certificate verification operation and exploited in a DoS attack. Any application which performs certificate verification is vulnerable including OpenSSL clients and servers which enable client authentication. Segmentation fault for invalid PSS parameters (CVE-2015-0208) – Severity: Moderate – The signature verification routines will crash with a NULL pointer dereference if presented with an ASN.1 signature using the RSA PSS algorithm and invalid parameters. Since these routines are used to verify certificate signature algorithms this can be used to crash any certificate verification operation and exploited in a DoS attack. Any application which performs certificate verification is vulnerable including OpenSSL clients and servers which enable client authentication. ASN.1 structure reuse memory corruption (CVE-2015-0287) – Severity: Moderate – Reusing a structure in ASN.1 parsing may allow an attacker to cause memory corruption via an invalid write.

Such reuse is and has been strongly discouraged and is believed to be rare. PKCS7 NULL pointer dereferences (CVE-2015-0289) – Severity: Moderate – The PKCS#7 parsing code does not handle missing outer ContentInfo correctly. An attacker can craft malformed ASN.1-encoded PKCS#7 blobs with missing content and trigger a NULL pointer dereference on parsing. Base64 decode (CVE-2015-0292) – Severity: Moderate – A vulnerability existed in previous versions of OpenSSL related to the processing of base64 encoded data. Any code path that reads base64 data from an untrusted source could be affected (such as the PEM processing routines). Maliciously crafted base 64 data could trigger a segmenation fault or memory corruption. This was addressed in previous versions of OpenSSL but has not been included in any security advisory until now.

DoS via reachable assert in SSLv2 servers (CVE-2015-0293) – Severity: Moderate – A malicious client can trigger an OPENSSL_assert (i.e., an abort) in servers that both support SSLv2 and enable export cipher suites by sending a specially crafted SSLv2 CLIENT-MASTER-KEY message. Empty CKE with client auth and DHE (CVE-2015-1787) – Severity: Moderate – If client auth is used then a server can seg fault in the event of a DHE ciphersuite being selected and a zero length ClientKeyExchange message being sent by the client. This could be exploited in a DoS attack. Handshake with unseeded PRNG (CVE-2015-0285) – Severity: Low – Under certain conditions an OpenSSL 1.0.2 client can complete a handshake with an unseeded PRNG. Use After Free following d2i_ECPrivatekey error (CVE-2015-0209) – Severity: Low – A malformed EC private key file consumed via the d2i_ECPrivateKey function could cause a use after free condition.

This, in turn, could cause a double free in several private key parsing functions (such as d2i_PrivateKey or EVP_PKCS82PKEY) and could lead to a DoS attack or memory corruption for applications that receive EC private keys from untrusted sources. This scenario is considered rare. X509_to_X509_REQ NULL pointer deref (CVE-2015-0288) – Severity: Low – The function X509_to_X509_REQ will crash with a NULL pointer dereference if the certificate key is invalid. This function is rarely used in practice. New versions of OpenSSL are available as listed below: OpenSSL 1.0.2a is now available , including bug and security fixes. OpenSSL 1.0.1m is now available , including bug and security fixes. OpenSSL 1.0.0r is now available , including bug and security fixes. OpenSSL 0.9.8zf is now available , including bug and security fixes.

March 4, 2015 by Ethical Hacker ( LiveHacking.Com ) – FREAK (or ‘Factoring attack on RSA-EXPORT Keys’) is a newly disclosed vulnerability that can force browsers into using weaker encryption keys. Once the connection is using weaker keys then the traffic can be cracked relatively quickly. This then exposes all the information that was being sent over the secure connection. The vulnerability stems directly from an old U.S. government policy that made it illegal to export strong encryption and required that weaker “export-grade” products be shipped to customers in other countries. These export restrictions were lifted in the late 1990s, but the weaker encryption got built-in into widely used software, some of which made its way back into USA. In the 1990s the USA only allowed companies to create technology with 512-bit encryption for use overseas. The law was designed to limit the trade in military technology. But 512-bit encryption has long been seen as “unacceptably weak” and most security experts thought that its use had ceased completely. According to the Washington Post , it is possible to crack the export-grade encryption key in about seven hours, using computers on Amazon Web services.

The site freakattack.com has a list of sites that are vulnerable to FREAK. The list “includes news organizations, retailers and financial services sites such as americanexpress.com.” According to Nadia Heninger, a University of Pennsylvania cryptographer, over 5 million sites are vulnerable to this attack vector. FREAK has been assigned the Common Vulnerabilities and Exposures identifier CVE-2015-0204 . According to the description, “The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct RSA-to-EXPORT_RSA downgrade attacks and facilitate brute-force decryption by offering a weak ephemeral RSA key in a noncompliant role.” According to a security advisory from OpenSSL , “an OpenSSL client will accept the use of an RSA temporary key in a non-export RSA key exchange ciphersuite.

A server could present a weak temporary key and downgrade the security of the session.” This issue affects all current OpenSSL versions: 1.0.1, 1.0.0 and 0.9.8. OpenSSL 1.0.1 users should upgrade to 1.0.1k, OpenSSL 1.0.0 users should upgrade to 1.0.0p, and OpenSSL 0.9.8 users should upgrade to 0.9.8zd. This issue was reported to OpenSSL on 22nd October 2014 by Karthikeyan Bhargavan of the PROSECCO team at INRIA. The fix was developed by Stephen Henson of the OpenSSL core team the following day. It also looks like Android’s web browser and Apple’s Safari browser are vulnerable.

According to Matt Green , “A group of cryptographers at INRIA, Microsoft Research and IMDEA have discovered some serious vulnerabilities in OpenSSL clients (e.g., Android) and Apple TLS/SSL clients (e.g., Safari) that allow a ‘man in the middle attacker’ to downgrade connections from ‘strong’ RSA to ‘export-grade’ RSA.” April 15, 2014 by Ethical Hacker It looks like the ramifications of the Heartbleed bug in OpenSSL will be felt for quite a while to come. While security analysts are asking if the NSA had prior knowledge of the bug, cyber criminals are at work stealing data from sites which haven’t patched their servers and changed their SSL certificates. The Canadian Revenue Agency has said that the Heartbleed bug was the reason why an attacker was able to steal 900 social insurance numbers , and British parenting website Mumsnet said that username and password data used to authenticate users during log in was accessed before the site was able to patch its servers. As for the NSA, the Director of National Intelligence has issued a statement saying that the NSA was not aware of the Heartbleed vulnerability until it was made public.

The statement went on to say that the Federal government relies on OpenSSL the same as everyone else to protect the privacy of users of government websites and other online services. However, what is even more important is that the statement categorically says that had the NSA, or any other of the agencies and organizations which make up the U.S. intelligence community, found the bug they would have reported it to the OpenSSL project. “If the Federal government, including the intelligence community, had discovered this vulnerability prior to last week, it would have been disclosed to the community responsible for OpenSSL,” said the statement issued by the ODNI Public Affairs Office. The statement also said that when Federal agencies discover a new vulnerability “it is in the national interest to responsibly disclose the vulnerability rather than to hold it for an investigative or intelligence purpose.” The Office of the Director of National Intelligence also said that in response to the President’s Review Group on Intelligence and Communications Technologies report that it had reinvigorated an interagency process for deciding when to share vulnerabilities.

According to the report, “The US Government should take additional steps to promote security, by (1) fully supporting and not undermining efforts to create encryption standards; (2) making clear that it will not in any way subvert, undermine, weaken, or make vulnerable generally available commercial encryption; and (3) supporting efforts to encourage the greater use of encryption technology for data in transit, at rest, in the cloud, and in storage.” Such a statement is important following the accusations that the NSA tried (and succeeded) in weakening certain encryption standards . The report also says that, “US policy should generally move to ensure that Zero Days are quickly blocked, so that the underlying vulnerabilities are patched on US Government and other networks. In rare instances, US policy may briefly authorize using a Zero Day for high priority intelligence collection, following senior, interagency review involving all appropriate departments.” This “rare” use of zero-day vulnerabilities was reiterated by the ODIN statement. “Unless there is a clear national security or law enforcement need, this process is biased toward responsibly disclosing such vulnerabilities.” April 8, 2014 by Ethical Hacker A serious security bug has been found in the ubiquitous OpenSSL encryption library that allows data to be stolen in its unencrypted form.

According to the heartbleed.com website, which was set up expressly to inform system admins about the potential dangers, the Heartbleed bug can be exploited from the Internet and it allows an attacker to read up to 64k of the server’s memory at one time. By reading the memory an attacker can gain access to “the secret keys used to identify the service providers and to encrypt the traffic” along with “the names and passwords of the users and the actual content.” It means that attackers can eavesdrop communications that should have been otherwise encrypted. A patched version of OpenSSL has already been published. According to the release notes, “a missing bounds check in the handling of the TLS heartbeat extension can be used to reveal up to 64k of memory” on a connected client or server. The OpenSSL project publicly thanked Neel Mehta of Google Security for discovering this bug and Adam Langley with Bodo Moeller for preparing the fix. It is recommended that all OpenSSL 1.0.1 users should upgrade to OpenSSL 1.0.1g. Those unable to immediately upgrade should recompile OpenSSL with -DOPENSSL_NO_HEARTBEATS.

OpenSSL 1.0.0 and OpenSSL 0.9.8 are not vulnerable. Heartbleed isn’t a design flaw in the SSL/TLS protocol specification but rather a bug in OpenSSL’s implementation of the TLS/DTLS (transport layer security protocols) heartbeat extension (RFC6520). Because the bug can expose the keys used for encrypting the connection, attackers are able to decrypt any past and future traffic to the encrypted connection since the primary keys have been exposed. Unfortunately to remedy the problem, not only does the server require patching but all the compromised keys need to be revoked and new keys reissued. It also means that users who have used an encrypted service (say a web mail service, online shopping or cloud service) will need to change their passwords as potentially the connection used to log in was not secure. One very worrying aspect of this bug is not only the widespread use of OpenSSL, but also that the first vulnerable version was published two years ago. If this bug has been previously found (but not disclosed) by cyber criminals or government run security agencies then the last two years worth of encrypted traffic should be deemed as exposed.

Even if it wasn’t found but the traffic was recorded then there are probably lots of state level agencies working right now to siphon off keys from around the net before things are revoked and changed. October 23, 2012 by Ethical Hacker After injecting a virus signature database via a MITM attack over broken SSL, the AntiVirus app recognized itself as a virus and recommended to delete the detected malware. Security researchers from the Leibniz University of Hanover and the computer science department at the Philipps University of Marburg have tested 13,500 popular free Android apps and found that 8.0% of these apps contain SSL/TLS implementations that are vulnerable to Man-in-the-Middle (MITM) attacks. The researchers created a tool called MalloDroid which is designed to detect potential vulnerabilities against MITM attacks. The tool performs static code analysis to analyze the networking API calls and extract valid HTTP(S) URLs, check the validity of the SSL certificates of all the extracted HTTPS hosts; and identify apps that contain non-default trust managers. Running the tool on the 13,500 samples showed that 1,074 of the apps exhibited some kind of potential vulnerability.

From this 1,074 app a further 100 apps were picked for manual audit to investigate different SSL problem including the accepting of all SSL certificates regardless of their validity. This manual audit revealed that 41 of the apps were vulnerable to MITM attacks due to SSL misuse. A particularly embarrassing case the researchers found that the Zoner AntiVirus app updated its virus signatures via a broken SSL connection. As the developers considered the connection to be secure and couldn’t be tampered with there is no built-in verification or validation of the signature files downloaded. This meant that the team was able to insert its own signatures files. In one test they added the signature for the anti-virus app itself. The app then proceeded to recognize itself as malware and recommended that itself be to deleted. The Zoner AntiVirus app has been downloaded more than 500,000 times! By the end of their research the team had managed to capture credentials for American Express, Diners Club, Paypal, Facebook, Twitter, Google, Yahoo, Microsoft Live ID, Box, WordPress, IBM Sametime, remote servers, bank accounts and email accounts.

The total cumulative number of installs of all the MITM vulnerable apps is between 39.5 and 185 million users, according to the download numbers from Google’s Play Store. April 27, 2012 by Ethical Hacker ( LiveHacking.Com ) – SSL Pulse , a new project that monitors the quality of SSL sites across the Internet and reports on its findings, has discovered that 90% of all HTTPS websites are insecure. The project has tested the top 200,000 SSL web sites on the Internet and discovered that nearly 180,000 of them are insecure. The project measures key features about an SSL configuration and ranks the website according to the SSL Server Rating Guide . According to the report 40% of the worlds top SSL sites use 128 bit (or less) ciphers for data transfer and a handful of sites have certificates with keys below 1024 bits. The biggest weaknesses are insecure renegotiation and susceptibility to a BEAST attack. Over 8,500 sites support insecure renegotiation which since 2009 as been considered insecure.

A successful exploitation of this vulnerability allows an active man-in-the-middle attacker to inject arbitrary content into an encrypted data stream. The results is that the attacker can impersonate a valid client and steal confidential data. The SSL Pulse survey reports that 75% of SSL websites are still open to BEAST attacks. A BEAST attack is based on a flaw in the SSL protocol. A successful exploitation of this issue will result in a disclosure of a victim’s session cookies, allowing the attacker to completely hijack the application session. It was resolved in TLS v1.1, but now six years later, most clients and servers do not support newer protocol versions. To protected against a BEAST attack servers need to be configured to use TLS v1.1 or to only use RC4 with TLS v1.0 or SSL v3.0. “About 50% (99,903 sites) got an A, which is a good result.

Unfortunately, many of these A-grade sites (still) support insecure renegotiation (8,522 sites, or 8.5% of the well-configured ones) or are vulnerable to the BEAST attack (72,357 sites, or 72.4% of the well-configured ones). This leaves us with only 19,024 sites (or 9.59% of all sites) that are genuinely secure at this level of analysis,” wrote Ivan Ristic, director of engineering at Qualys and creator of SSL Labs. The project hopes that these startling numbers will raise awareness of these issues and help web site owners improve their SSL implementations. February 29, 2012 by Ethical Hacker ( LiveHacking.Com ) – New security updates for all active versions PostgreSQL, the object-relational database system, have been released by the PostgreSQL Global Development Group. The updates are available for versions 9.1.3, 9.0.7, 8.4.11 and 8.3.18. The update fixes vulnerability in three areas: Permissions on a function called by a trigger are not checked.

SSL certificate name checks are truncated to 32 characters, allowing connection spoofing under some circumstances. Line breaks in object names can be exploited to execute code when loading a pg_dump file. The first fix prevents users from defining triggers which execute functions for which the user does not have EXECUTE permission. The problem was that CREATE TRIGGER failed to make any permissions check on the trigger function to be called. If the trigger function was marked SECURITY DEFINER, privilege escalation becomes possible. The SSL fix resolves a problem with SSL common name truncation, which could allow hijacking of an SSL connection under exceptional circumstances. Since the name extracted from an SSL certificate was incorrectly truncated to 32 characters it was theoretically possible to spoof the name on a false certificate. The final security fix is to the pg_dump program. pg_dump copies object names into comments in a SQL script without sanitizing them by using an object name which includes a newline it is possible to add SQL commands to the dump script. When the dump script is reloaded, the command would be executed with the privileges of whoever is running the script. Users of pg_dump, users of SSL certificates for validation or users of triggers using SECURITY DEFINER should upgrade their installations immediately.

This release also contains 45 fixes to version 9.1, and a smaller number of fixes to older versions, including: Fix btree index corruption from insertions concurrent with vacuuming Recover from errors occurring during WAL replay of DROP TABLESPACE Fix transient zeroing of shared buffers during WAL replay Fix postmaster to attempt restart after a hot-standby crash Fix corner case in SSI transaction cleanup Update per-column permissions, not only per-table permissions, when changing table owner Fix handling of data-modifying WITH subplans in READ COMMITTED rechecking Fix for “could not find plan for CTE” failures Fix unsupported node type error caused by COLLATE in an INSERT expression Avoid crashing when we have problems deleting table files post-commit Fix recently-introduced memory leak in processing of inet/cidr Fix GIN cost estimation to handle column IN (…) index conditions Fix I/O-conversion-related memory leaks in plpgsql Teach pg_upgrade to handle renaming of plpython’s shared library (affecting upgrades to 9.1) More information about the updates, including a full list of fixes and changes, can be found in the 9.1.3 , 9.0.7 , 8.4.11 and 8.3.18

 release notes.

PostgreSQL can be downloaded from: Main download page: February 20, 2012 by Ethical Hacker ( LiveHacking.Com ) – Mozilla has sent an email to all certificate authorities in the Mozilla root program to reiterate that the issuance of subordinate CA certificates for the purposes of SSL man-in-the-middle interception or traffic management is unacceptable. Mozilla has asked the CAs to revoke any such certificates by April 27, 2012. After that date, if it is found that a subordinate CA is being used for MITM, Mozilla could remove the corresponding root certificate from the Mozilla root program. This would mean the applications like Mozilla FireFox wouldn’t accept the certificate when presented. “We made it clear that this practice remains unacceptable even when the intended deployment of such a certificate is restricted to a closed network,” said Johnathan Nightingale, Senior Director of Firefox Engineering. Mozilla also reinforced the the Certificate Authorities responsibilities reminding them that they are accountable for every certificate they sign, directly or through its subordinates. This isn’t the first time Mozilla has asked CAs to be more responsible.

In September 2011 Mozilla sent a message to all the certificate authorities (which participate in the Mozilla root certificate program) requesting that they complete an audit of their PKI systems. This call to review and confirm the integrity of their certificate systems came after Mozilla removed the DigiNotar root certificate in response to its failure to promptly detect, contain, and notify Mozilla of a security breach regarding their root and subordinate certificates. February 17, 2012 by Ethical Hacker ( LiveHacking.Com ) – Two new research papers ( here and here ) have been published which examine the low level details of SSL, specifically randomness aspects, and the results are surprising. According to the “Ron was wrong, Whit is right” paper, two out of every one thousand RSA moduli that on the Internet today offer no security. While the Princeton’s Center for Information Technology Policy blog shows that 0.4% of all the public keys used for SSL web site security can be remotely compromised. Two in one thousand is 0.2%, Princeton is talking 0.4%.

These aren’t huge numbers… but a search on Google for how many sites have “https://” in the URL shows 19,640,000,000 sites. Some of these are sites about HTTPS and aren’t secure sites. If just one quarter of those are really using https, that is 4,910,000,000 sites. 0.4% of 1,964,000,000. That is a lot of SSL certificates. And a huge potential number of sites which can be hacked. “Our conclusion is that the validity of the assumption is questionable and that generating keys in the real world for “multiple-secrets” cryptosystems such as RSA is signi cantly riskier than for “single-secret” ones such as ElGamal or (EC)DSA which are based on Die-Hellman,” wrote Arjen K. Lenstra et al. SSL has been having a hard time recently and it is starting to look as if this system isn’t as robust as previously thought. Recent SSL stories include the BEAST , Diginotar and Verisign .

“Unfortunately, we’ve found vulnerable devices from nearly every major manufacturer and we suspect that more than 200,000 devices, representing 4.1% of the SSL keys in our dataset, were generated with poor entropy. Any weak keys found to be generated by a device suggests that the entire class of devices may be vulnerable upon further analysis,” wrote Nadia Heninger. January 20, 2012 by Ethical Hacker ( LiveHacking.Com ) – Earlier this month, the OpenSSL project released updates to two new versions (OpenSSL 1.0.0f and 0.9.8s) of the popular open source toolkit for SSL/TLS to fix a total of six security flaws. One of the vulnerabilities fixed (CVE-2011-4108) was in OpenSSL’s DTLS implementation which allowed an efficient plaintext recovery attack. However Antonio Martin from Cisco Systems, Inc found a flaw in the in the fix that can be exploited in a denial of service attack. Only DTLS applications using OpenSSL 1.0.0f and 0.9.8s are affected.

To remedy this the OpenSSL project have now released OpenSSL 1.0.0g and OpenSSL 0.9.8t. memory leak • Page 1 • Tag • The Register Time to SIP from Cisco's patch pool, to fix a memory leak Cisco's urging SIP users to patch their software, after discovering a remotely-exploitable denial-of-service vector in a memory leak. The issue was discovered while resolving a customer support issue, the company says. Since the same code is used across multiple systems, sysadmins need to check their vulnerability if they're … Bug-hunt turns up vuln in LibreSSL Updated Code reviewers looking over a mail daemon have turned up a couple of reasonably serious bugs in the Libre SSL code base – and along the way provided a handy illustration of the deep interdependencies between software.

What they've found is that there's a companion memory leak (CVE-2015-5333) and buffer overflow (CVE-2015-5334 … Awoogah: Get ready to patch 'severe' bug in OpenSSL this Thursday Sysadmins and anyone else with systems running OpenSSL code: a new version of the open-source crypto library will be released this week to "fix a single security defect classified as 'high' severity." The bug, we're told, will be addressed in versions 1.0.2d and 1.0.1p of the software. The vulnerability does not affect the 1.0 … Facebook: Your code sucks, and we don't even have to run it to tell Facebook has released the source code to Infer, its static analysis tool, under the open source BSD license. Static analysis tools like Infer are used as a complement to traditional dynamic software testing by scanning the source code of software to spot trouble spots without actually executing the code.

In a Thursday blog … BOFH : Getting to the brown, nutty heart of the water cooler matter Episode 6 "..and so we just mix all the ingredients together like this, tip it out onto a surface like so, and roll it into a roughly cylindrical shape. Now we just push in the extras and then pop it into the freezer for a few hours till it's nice and hard and easy to handle. And we're done," the PFY says with a flourish. I can't … The Reg's review of 2014: Naked JLaw selfies, Uber and monkey madness Facebook buying WhatsApp for nearly as much as Hewlett-Packard spent on Compaq in 2001? Well, 2014 was the year of the selfie, after all. Just don't let that snapshot of your bits get hacked. Leaked naked smartphone pics weren't this year's only embarrassing public spectacles: Microsoft's CEO put his foot in his mouth on women … Admins!

Never mind POODLE, there're NEW OpenSSL bugs to splat Poodle If you're using the popular OpenSSL open source cryptography library, you have more to worry about than the recently disclosed POODLE (Padding Oracle On Downgraded Legacy Encryption) vulnerability, project devs have warned. In addition to patching two POODLE-related bugs, new releases of OpenSSL issued on Wednesday also close … Amazon carefully stitches up Heartbleed OpenSSL hole Amazon is working to patch "Heartbleed" memory-leak vulnerablities in its Amazon Web Services hosting infrastructure. The mammoth cloud company confirmed on Tuesday that it has dealt with some of the parts of its infrastructure that were vulnerable to the nasty OpenSSL 1.0.1 bug nicknamed "Heartbleed" that was disclosed on … Running OpenSSL? Patch now to fix CRITICAL bug Sysadmins using the OpenSSL cryptographic library have an urgent job: patching a memory leak vulnerability that could reveal user IDs and passwords. Dubbed “Heartbleed”, the vulnerability was discovered by Google Security's Neel Mehta and announced by CloudFlare. As the terse OpenSSL advisory states: “A missing bounds check … New Flash vuln exploited (again).

Adobe posts emergency fix (again) Adobe has released an update to address critical flaws in its Flash Player software, one of which is being actively targeted in the wild. The company said that the Windows and Mac OS X builds of Flash Player 12.0.0.44 and earlier, and Flash Player 11.2.202.336 and earlier for Linux, must be upgraded to fix a trio of bugs. Adobe … Cisco goes public with major vulns Users of Cisco's Unified Communications Manager, UCM instant messaging and presence, and Prime Central hosted collaboration system need to get busy with patches, after the Borg announced denial-of-service vulnerabilities across all three platforms. UCM 7.1, Cisco advises, has an improper error handling vulnerability that can be … Virtualisation: just a lot of extra software licences? A colleague of mine recently remarked that x86 virtualisation makes no sense to any organisation that is cost conscious. I am an early adopter of virtualisation and wanted to know what he meant.

“When using virtualisation, you are paying for far more software licences than you would if you were to take the time to implement … Virgin Media finally offers network options on SuperHub Virgin Media has finally issued an update for its SuperHub box that allows its customers to configure custom network set-ups with the kit. The latest firmware upgrade (R30) comes seven months after VM debuted SuperHub, which was immediately hampered by stability issues and slow connections. Many customers grumbled about the … Apachesourcers claw out major Tomcat revision One of the Apache Software Foundation's earliest projects has seen its first major update in four years, with the twin goals of easing development and boosting performance.

Tomcat 7.0 has been updated to fully implement Java Servlet 3.0, JavaServer Pages (JSP) 2.2, and Expression Language (EL) 2.2 to improve support for … Lucid Lynx fights 'major' X-Server memory leak Update The Ubuntu 10.04 release candidate contains a "major" X-Server memory leakage bug that "causes the computer to get slower and slower over time." According to a bug report, the problem can cause system instability after "a day or two uptime" - depending on memory quantity and usage. Developers have proposed a fix, but it's … IBM claims patents promote open-source love Open source and software patents are generally regarded as two things that go together like peanut butter and a punch to the face*. Open-source advocates talk of vague, badly written US patents lurking in the system, waiting only to pounce on unsuspecting devs and condemn them to 1,001 years litigation. Open sourcers actively … Microsoft gets personal on Windows 7 "show stopper" bug Microsoft has gotten personal in responding to reports of a "show stopper" bug in Windows 7 capable of delaying the planned roll-out, which starts Thursday.

The company has blamed a chip-set controller issue rather than a critical bug in the Windows 7 chkdsk /r tool that could cause a memory leak capable of causing your PC to … Virtualization rocks - but who cares beyond consolidation? Reader Workshop The feedback on virtualization experiences from those participating so far in our latest online workshop has been generally very positive. A main focus of the comments has been on server consolidation and the cost savings that come with it, and some of the results achieved seem pretty impressive: We're running about 15 VMs … IBM unveils nano-projector based VirtuaHuman with 1TB of memory April Fools Don Eigler – a researcher famous for spelling I-B-M with individual atoms – stunned the world once again today by revealing on his blog that a creature known as Robert Scoble is really a research project. A few years back, IBM researchers started to think more and more about the potential rise of so-called virtual worlds … Mozilla reaches stage 4 of Firefox 3 beta endurance test The fourth beta release of Firefox 3 is available for download today from Mozilla. Grab it here if you're feeling adventurous. Remember it's a beta, so beware of rushing to code where angels fear to thread.

The browser's latest build boasts several improvements over previous beta releases, including a speed boost, full-page … Beyond the valley of the drolls Stob There's another of those lists of supposedly amusing/sage/cute adages going around, bouncing from blog to email, accumulating fresh contributions and occasional edits and doing all the meme-ish things that memes do. This one differs from all the others that you have deleted irritably from your email inbox in that it includes a … Intel Wi-Fi update ate my CPU cycles Security researchers have identified performance problems with a recent wireless driver security update from Intel. Vulnerabilities in Centrino device drivers for Windows and Intel's PROSet management software prompted a security update three weeks ago. The initial update weighed in at more than 100MB, though Intel did produce … How the US military chivvied up Microsoft Divine intervention, or simply a divine coincidence? Long suffering Tablet PC users weary of unscheduled reboots didn't mind too much last week. Over a year after it came to light, and months after we highlighted the issue, Microsoft finally issued a patch for the memory leak that caused the problem. One pundit called it "the … Miracle in Redmond!

Tablet PC memory bug fixed Microsoft has finally issued a patch for a notorious bug in the Tablet PC edition of Windows XP. The bug is a memory leak in the default digitizer that ships with the system, and has been irking users for over a year. The digitizer process gradually ate up all available system memory, grinding the machine to a halt, and … Reboot daily, Tablet users advised Microsoft has publicly acknowledged the Tablet PC bug that eats up the computer's memory until the machine crashes. The out of control memory leak remains unchecked while Redmond's Red Adairs grapple to put a lid on the blow-out. But there's no word yet of exactly when a fix will be issued. "Progress is being made and there'll … Tablet PC bug 'fills computer with ink' A major bug in the Tablet PC version of Windows eats up all the memory in your computer until it crashes. Redmond has yet to acknowledge the problem with a public disclosure about the issue - or even offer a feeble blogshrug [*]. The culprit is the application Tabtip.exe, the site Tablet PC Talk confirms - "The program Tabtip.

… BOFH: Hooking the IT vending piranha Episode 2 So we've been dragged into Beancounter land after a change in purchasing policy means that absolutely all kit is now going to be bought by the IT Purchasing bloke in accounts to make sure that we get the absolute best deal that we POSSIBLY could ever get. Which means: we're going to get royally screwed by the vendors. As any … Borland JBuilder 7 Review VERDICT: It's laden with features, but at version 7 JBuilder faces stiff competition from leaner, more modular alternatives. SPECIFICATIONS: Written in Java and runs on JDK 1.3.1 and anywhere that JDK runs. Supports Windows NT 4, 2000 or XP, Red Hat Linux, Solaris on UltraSPARC II or higher and Mac OS X. PRICE: £2,149 ( … Registry hack turns XP Pro into server, vice versa A routine currently circulating on the web reawakens the old controversy over how different the workstation and server versions actually are.

NTSwitch, apparently produced by Hungarian outfit 3am Labs, is claimed to allow various versions of Microsoft workstation operating systems to be turned into server versions, and vice … Serious Outlook hole patched MS Bug Roundup MS has patched a serious vulnerability in Outlook 2002 by which an attacker could take over one's machine. At issue is an ActiveX feature, the Outlook View Control, which enables mail folders to be viewed via Web pages. In Outlook 2K the flaw doesn't give up control, but could allow for minor mischief. MS suggested a workaround … MS firewall is holier than the Pope Updated Microsoft's much vaunted first security product has become the subject of three separate security problems. Internet Security and Acceleration (ISA) server 2000, which was positioned by Microsoft as a credible alternative to corporate firewalls, has become the subject of two denial of service and one cross site scripting flaws … Four new ways to stuff someone's Win machine MS Bug Roundup: We've seen another spike in Microsoft security bulletins during the past few days. Funny how these things seem to run in cycles.... First up, a nifty hole which affects RPC (Remote Procedure Calling), which is used chiefly to support distributed applications.

In this instance, a malicious RPC request can cause a denial of … Exploits for several million Microsoft servers posted Several exploits have been developed for a buffer overflow vulnerability in servers running IIS 5.0 on Windows 2000 Server, Windows 2000 Advanced Server and Windows 2000 Datacenter Server, which we reported on Tuesday. The vulnerability exists in the .printer ISAPI (Internet Server Application Programming Interface) filter (C:\ … Foster is Pentium 4 Doppelganger Sources close to Intel in Japan have told The Register that Foster, the server version of the Pentium 4, and which is expected sometime in the first half of next year, will now support double data rate (DDR) memory, although Rambus memory still remains something of an option for high end workstation platforms. Foster has … DoJ's ‘Punch’ beats MS' ‘Judy’ MS on Trial Computer scientist Professor Edward Felten from Princeton was recently deposed prior to his appearance as a rebuttal witness for the DoJ in the Microsoft trial.

In many ways the Steve and Steve Show -- Steve Holtzman for the DoJ and Steve Holley of Sullivan & Cromwell for Microsoft -- was like a Punch and Judy show, and there … Allchin takes a beating over video We conclude the story of last week's dramatic events when Microsoft was caught faking a demonstration to the court. (Full Video Transcript) Jim Allchin, bruised by David Boies' relentless cross examination, went into a rehearsed redirect examination from Stephen Holley. Allchin probably had a poor lunch, since he had spent most … MacOS 8.5.1 fixes bug Apple claimed wasn't a problem Apple is preparing an update for MacOS 8.5, due to ship early next year, but possibly in line to appear later this month. The new release, MacOS 8.5.1 interestingly appears to solve a problem that Apple had previously denied existed, despite numerous complaints from users. Since the release of 8.5, many Mac owners have informed …

Question: What internet vulnerability 'bug' was announced (in April 2014) to have existed in 17% of the world's web servers since end-2011?
Answer: Heartbleed