Via BetaNews -
Small French software developer PointDev is suing Sony BMG saying it uses pirated copies of PointDev's Ideal Migration software.
The application manages Windows domain consolidations and provides migration tools to move networks to Windows 2000 and 2003. Sony is being accused of using this software without a license.
Sony's position smacks of irony, considering that it, along with other record labels have taken a hardline stance against piracy. Its offices were raided in January after PointDev obtained a search warrant from the courts.
In those raids, at least four servers were found with unlicensed copies of Ideal Migration on them. They were seized as evidence, which PointDev has used as a basis for its suit against the company.
"We are not interested in an amicable settlement. It is not just a question of money but more importantly in principle," CEO Agustoni Paul-Henry said. He also implies that piracy may be a problem overall within the company.
Paul-Henry said he plans to make an example out of Sony to ensure that other companies know they will not be free from prosecution.
"I think piracy is linked to the policy of a company. If the employee has the necessary funding to buy the software they need, it will," a translation of the report from La Province reads. "If this is not the case, he will find alternative ways, as the work must be done in one way or another."
Essentially, the company feels that this is not the work of a single employee, but is rather an act of ignorance by the company overall, meaning it could be endemic.
Sony reportedly attempted to have the La Province report quashed, but has otherwise remained quiet about the case.
Monday, March 31, 2008
Microsoft Office XP SP3 PPT File Buffer Overflow Exploit (MS08-016)
Runs calc.exe on Office XP SP3 with updates <>
Just for fun...
http://milw0rm.com/sploits/2008-ms08-016.tgz
Marsupilamipowa@hotmail.fr
http://www.milw0rm.com/exploits/5320
Just for fun...
http://milw0rm.com/sploits/2008-ms08-016.tgz
Marsupilamipowa@hotmail.fr
http://www.milw0rm.com/exploits/5320
Apple Lags Microsoft in Security Response
Via The Register UK -
---------------------
This research reinforces what I have been saying for quite sometime - readers of this blog won't be shocked by this research either.
I have been pretty critical of Apple's lack of disclosure and patch process over the years:
http://djtechnocrat.blogspot.com/2008/03/apple-megapatch-includes-long-lost.html
http://djtechnocrat.blogspot.com/2007/12/apple-fails-to-properly-inform-public.html
http://djtechnocrat.blogspot.com/2007/12/apple-finally-fixes-quicktime.html
http://djtechnocrat.blogspot.com/2007/03/apple-issues-megapatch.html
http://djtechnocrat.blogspot.com/2006/10/apple-sliently-hurts-its-users.html
http://djtechnocrat.blogspot.com/2006/05/apple-releases-whopping-43-security.html
Apple needs to realize that vulnerabilities aren't a PR problem - everyone has vulnerabilities. Microsoft, Cisco, Sun, Dell, HP, Linux, everyone.
Not dealing with vulnerabilities in an open and timely manner is the real PR problem.
Remaining silent in the face of active internet exploitation is just stupid, in my view.
Throwing your customers under the exploit bus just so you don't have to talk about vulnerabilities is proof to me that Apple isn't serious about protecting their customers (not yet anyways).
Apple is trailing way behind Microsoft in security patch responsiveness, according to a study by security researchers.
Stefan Frei and Bernard Tellenback of the Computer Engineering and Networks Laboratory (TIK) at the Swiss Federal Institute of Technology, analysed several years of vulnerability disclosures and patching processes from various vendors.
They found that Apple is getting worse at dealing with security problems while Microsoft is improving. Apple is experiencing more vulnerabilities, longer patching times, and more attacks on unpatched vulnerabilities, according to the duo.
Frei and Tellenback presented their findings at a presentation entitled 0-day Patch – Exposing Vendors (In)Security Performance at last week's Black Hat conference in Amsterdam. A copy of the presentation can be found here.
Colleagues of the duo reckon Apple's antagonistic attitude with security researchers is one of the reasons for its poor response.
"While I think that there are quite a few reasons why this is probably so, I’d be inclined to say that Apple’s biggest problem appears to be that they treat every new vulnerability as a potential PR disaster rather than an opportunity to visibly reinforce their work in securing their customers," writes Gunter Ollman of IBM's X-Force.
"In recent times this has most critically been reflected in the way Apple works with security researchers."---------------------
This research reinforces what I have been saying for quite sometime - readers of this blog won't be shocked by this research either.
I have been pretty critical of Apple's lack of disclosure and patch process over the years:
http://djtechnocrat.blogspot.com/2008/03/apple-megapatch-includes-long-lost.html
http://djtechnocrat.blogspot.com/2007/12/apple-fails-to-properly-inform-public.html
http://djtechnocrat.blogspot.com/2007/12/apple-finally-fixes-quicktime.html
http://djtechnocrat.blogspot.com/2007/03/apple-issues-megapatch.html
http://djtechnocrat.blogspot.com/2006/10/apple-sliently-hurts-its-users.html
http://djtechnocrat.blogspot.com/2006/05/apple-releases-whopping-43-security.html
Apple needs to realize that vulnerabilities aren't a PR problem - everyone has vulnerabilities. Microsoft, Cisco, Sun, Dell, HP, Linux, everyone.
Not dealing with vulnerabilities in an open and timely manner is the real PR problem.
Remaining silent in the face of active internet exploitation is just stupid, in my view.
Throwing your customers under the exploit bus just so you don't have to talk about vulnerabilities is proof to me that Apple isn't serious about protecting their customers (not yet anyways).
Sunday, March 30, 2008
Learn to Be Kind
Via sciam.com -
New research from the University of Wisconsin-Madison finds that we can acquire a greater capacity for compassion through meditation training, in much the same way as athletes or musicians train to improve their skill.
We’re in the midst of a revolution in brain science. The long-held dogma that brain connections are unchangeable after age five, is being usurped with findings that the brain is more plastic than we thought.
Researchers at the University of Wisconsin-Madison published a study in PLoS One this week, showing that our capacity for empathy can be learned and mastered – as one might learn to play soccer or piano. The skill here comes from meditation.
They studied the fMRI scans of 32 subjects, half were trained meditators including the Olympians of meditation, the Tibetan monks. The others were age-matched novices.
In the brain scanner, all were subjected to emotional sounds (like a baby laughing or woman screaming.)
They found that the insula (the area of the brain responsible for physical feelings of compassion) was highly active in the experts. And the right temporal-parietal juncture (an area connected to understanding anothers’ emotional state) was also much more active in experts than in the novices.
It may not be proof that we can turn a schoolyard bully into Ghandi, but it shows meditative training has a significant impact.
New research from the University of Wisconsin-Madison finds that we can acquire a greater capacity for compassion through meditation training, in much the same way as athletes or musicians train to improve their skill.
We’re in the midst of a revolution in brain science. The long-held dogma that brain connections are unchangeable after age five, is being usurped with findings that the brain is more plastic than we thought.
Researchers at the University of Wisconsin-Madison published a study in PLoS One this week, showing that our capacity for empathy can be learned and mastered – as one might learn to play soccer or piano. The skill here comes from meditation.
They studied the fMRI scans of 32 subjects, half were trained meditators including the Olympians of meditation, the Tibetan monks. The others were age-matched novices.
In the brain scanner, all were subjected to emotional sounds (like a baby laughing or woman screaming.)
They found that the insula (the area of the brain responsible for physical feelings of compassion) was highly active in the experts. And the right temporal-parietal juncture (an area connected to understanding anothers’ emotional state) was also much more active in experts than in the novices.
It may not be proof that we can turn a schoolyard bully into Ghandi, but it shows meditative training has a significant impact.
British Judge: Social Network Friends Not Real Friends
Via smh.com.au -
A British judge has made official what many of us have long suspected - that being "Facebook friends" with someone doesn't necessarily make you their friend.
The magistrate was presiding over a harassment case in which a woman accused her former boyfriend of hounding her by sending her a "friend request" on the popular social networking site on January 21.
The ex-boyfriend, Michael Hurst, 34, was cleared of the charge after the magistrate accepted his argument that the contact was highly innocuous because being "Facebook friends" could not be defined as "friendship in the traditional sense".
"[Popular British radio DJ Chris Moyles] has 1 million Facebook friends. Do you think he knows them all intimately?" Mr Hurst said.
Geoff Dick, senior lecturer in information systems at the University of NSW, said he agreed with the judge that Mr Hurst wasn't actually asking to become friends with his ex-girlfriend and physically spend time with her. He was merely suggesting that they give each other access to their profile pages, pictures and comments.
Dr Dick said a lot of the time "friends" listed on the pages of Facebook or similar site MySpace were more like "acquaintances" and the more there were, the less friendly the profile owner was with them.
"If you only have 10 'friends' then they are probably your best friends, whereas if you have 1000 'friends' then clearly a lot of them are inconsequential," he said.
Dr Dick, who last year conducted a extensive study of MySpace use by teenagers, said most people now saw the networking sites as more of a communication medium than a circle of friends.
Although many "friends" listed on users' profiles were really acquaintances, problems still arose if one was to conduct a "cull" of them.
"Removing someone from your friend list is almost a declaration of war," Dr Dick said.
He said it was important to maintain true friendships in the traditional way - spending actual time together.
"If it's certainly possible, I would very much encourage people to make use of their real-life friends and use these [networking sites] as a supplement," he said.
----------------
Well, duh...CIA Chief Says Al-Qaida Has Safe Haven in Pakistan
Via VOA News -
The head of the U.S. Central Intelligence Agency says al-Qaida has established a safe haven in Pakistan's border areas, presenting a clear and present danger to the region and to the United States.
CIA director Michael Hayden said on U.S. television's Meet the Press program Sunday that the development took place over the past 18 months. He also said al-Qaida is training Western-looking operatives who could pass easily through U.S. borders.
His interviewer asked if the United States is stepping up attacks against al-Qaida suspects in Pakistani border regions near Afghanistan, as reported by a U.S. newspaper last week. Hayden said he could neither confirm nor deny that story.
A spokesman for the Pakistani Taliban told Reuters news agency today that his group welcomes the willingness of Pakistan's new government to negotiate peace in tribal areas, but he vowed the fight against U.S. forces in Afghanistan will continue.
The head of the U.S. Central Intelligence Agency says al-Qaida has established a safe haven in Pakistan's border areas, presenting a clear and present danger to the region and to the United States.
CIA director Michael Hayden said on U.S. television's Meet the Press program Sunday that the development took place over the past 18 months. He also said al-Qaida is training Western-looking operatives who could pass easily through U.S. borders.
His interviewer asked if the United States is stepping up attacks against al-Qaida suspects in Pakistani border regions near Afghanistan, as reported by a U.S. newspaper last week. Hayden said he could neither confirm nor deny that story.
A spokesman for the Pakistani Taliban told Reuters news agency today that his group welcomes the willingness of Pakistan's new government to negotiate peace in tribal areas, but he vowed the fight against U.S. forces in Afghanistan will continue.
Hacking Amtrak with Direct Object References
Via Arshan Dabirsiaghi's Blog -
I love taking the train. God, the only thing better than taking the train would be taking the train for free.
Whoops.
Thanks for the ticket, Marge Power, traveling from Alexandria, VA.
How was I able to do this? Direct object references (DOR). Laughably, ridiculously easy attacks. Is this a Diebold product? It’s no wonder that with this level of security, a 14 year old kid from Kerplakistan with a pasta drainer, wireless mouse and a shoebox was able to completely derail their trains. I’ve told my the webappsec classes that the easiest way to steal a bunch of information from a website is through direct object references. My wife could perform a DOR attack, and if you think she knows anything about security, I can just tell you she has like 5,000 Facebook applications with full privileges running.
So, let’s get to the really gory, technical details of this Mitnick like hack.
My confirmation number was 01CF01.
I typed in 01CF04.
Maybe it was by accident, Amtrak, and maybe it wasn’t. Regardless, I got Marge’s ticket offered to me. Look at the screen again. See the “Print Tickets” option? I’m sure this does happen all the time by accident. Whoever made this horribly insecure contraption knew that, too, because on the first picture, if you look closely, there’s a “Not you? Click here to try another confirmation number” button as well. You don’t need an ID to board a train, remember.
Incidentally, Marge Power is such a badass name. That’s why I didn’t get her tickets out. She sounds ripped.
I love taking the train. God, the only thing better than taking the train would be taking the train for free.
Whoops.
Thanks for the ticket, Marge Power, traveling from Alexandria, VA.
How was I able to do this? Direct object references (DOR). Laughably, ridiculously easy attacks. Is this a Diebold product? It’s no wonder that with this level of security, a 14 year old kid from Kerplakistan with a pasta drainer, wireless mouse and a shoebox was able to completely derail their trains. I’ve told my the webappsec classes that the easiest way to steal a bunch of information from a website is through direct object references. My wife could perform a DOR attack, and if you think she knows anything about security, I can just tell you she has like 5,000 Facebook applications with full privileges running.
So, let’s get to the really gory, technical details of this Mitnick like hack.
My confirmation number was 01CF01.
I typed in 01CF04.
Maybe it was by accident, Amtrak, and maybe it wasn’t. Regardless, I got Marge’s ticket offered to me. Look at the screen again. See the “Print Tickets” option? I’m sure this does happen all the time by accident. Whoever made this horribly insecure contraption knew that, too, because on the first picture, if you look closely, there’s a “Not you? Click here to try another confirmation number” button as well. You don’t need an ID to board a train, remember.
Incidentally, Marge Power is such a badass name. That’s why I didn’t get her tickets out. She sounds ripped.
Chaos Computer Club Releases Fingerprint of Germany's Interior Minister
Via The Register UK -
A hacker club has published what it says is the fingerprint of a Wolfgang Schauble, Germany's interior minister and a staunch supporter of the collection of citizen's unique physical characteristics as a means of preventing terrorism.
In the most recent issue of Die Datenschleuder, the Chaos Computer Club printed the image on a plastic foil that leaves fingerprints when it is pressed against biometric readers.
No-one from the Germany-based group has been able to test the foil to see if it can fool a computer into believing it came from Schauble. But the technique has been shown to work with a variety of other people's prints on almost two-dozen readers, according to a colleague of the hacker who pulled off the demonstration.
"The whole research has always been inspired by showing how insecure biometrics are, especially a biometric that you leave all over the place," said Karsten Nohl, a colleague of an amateur researcher going by the moniker Starbug, who engineered the hack. "It's basically like leaving the password to your computer everywhere you go without you being able to control it anymore."
...
Schauble's fingerprint was captured off a water glass he used last summer while participating in a discussion celebrating the opening of a religious studies department at the University of Humboldt in Berlin. The print came from an index finger, most likely the right one, Starbug believes, because Schauble is right-handed.
...
Schauble is big proponent of using fingerprints and other unique characteristics to identify individuals.
“Each individual’s fingerprints are unique," he is quoted as saying in this official interior department press release announcing a new electronic passport that stores individuals' fingerprints on an RFID chip. "This technology will help us keep one step ahead of criminals.
With the new passport, it is possible to conduct biometric checks, which will also prevent authentic passports from being misused by unauthorized persons who happen to look like the person in the passport photo."
The magazine is calling on readers to collect the prints of other German officials, including Chancellor Angela Merkel, Bavarian Prime Minister Guenther Beckstein and BKA President Joerg Ziercke.
"The thing I like a lot is the political activism of the hack," said Bruce Schneier, who is chief security technology officer for BT and an expert on online authentication. Fingerprint readers were long ago shown to be faulty, largely because designers opt to make the devices err on the side of false positives rather than on the side of false negatives.
Few readers, he said, have ways to verify the input path to prevent spoofing, and yet politicians frequently see them as a panacea for all kinds of complicated security problems.
"This minister guy, what is he going to do now?" Schneier asked. "His fingerprint is going to be known for all time."
A hacker club has published what it says is the fingerprint of a Wolfgang Schauble, Germany's interior minister and a staunch supporter of the collection of citizen's unique physical characteristics as a means of preventing terrorism.
In the most recent issue of Die Datenschleuder, the Chaos Computer Club printed the image on a plastic foil that leaves fingerprints when it is pressed against biometric readers.
No-one from the Germany-based group has been able to test the foil to see if it can fool a computer into believing it came from Schauble. But the technique has been shown to work with a variety of other people's prints on almost two-dozen readers, according to a colleague of the hacker who pulled off the demonstration.
"The whole research has always been inspired by showing how insecure biometrics are, especially a biometric that you leave all over the place," said Karsten Nohl, a colleague of an amateur researcher going by the moniker Starbug, who engineered the hack. "It's basically like leaving the password to your computer everywhere you go without you being able to control it anymore."
...
Schauble's fingerprint was captured off a water glass he used last summer while participating in a discussion celebrating the opening of a religious studies department at the University of Humboldt in Berlin. The print came from an index finger, most likely the right one, Starbug believes, because Schauble is right-handed.
...
Schauble is big proponent of using fingerprints and other unique characteristics to identify individuals.
“Each individual’s fingerprints are unique," he is quoted as saying in this official interior department press release announcing a new electronic passport that stores individuals' fingerprints on an RFID chip. "This technology will help us keep one step ahead of criminals.
With the new passport, it is possible to conduct biometric checks, which will also prevent authentic passports from being misused by unauthorized persons who happen to look like the person in the passport photo."
The magazine is calling on readers to collect the prints of other German officials, including Chancellor Angela Merkel, Bavarian Prime Minister Guenther Beckstein and BKA President Joerg Ziercke.
"The thing I like a lot is the political activism of the hack," said Bruce Schneier, who is chief security technology officer for BT and an expert on online authentication. Fingerprint readers were long ago shown to be faulty, largely because designers opt to make the devices err on the side of false positives rather than on the side of false negatives.
Few readers, he said, have ways to verify the input path to prevent spoofing, and yet politicians frequently see them as a panacea for all kinds of complicated security problems.
"This minister guy, what is he going to do now?" Schneier asked. "His fingerprint is going to be known for all time."
Saturday, March 29, 2008
LED Art Hits Boston for March 31st
Via Make Blog -
This is interesting - it seems that a group of artists have celebrated 1-31-07 in their own way and have created a series of political themed LED art sculptures and (you guessed it) placed them all over Boston. Pictured here, Bush & Bin Laden... Click on through to see more images and if you're in Boston the locations are listed to go on an art tour. Get there before the robots do.
Realtablist on Youtube
One of my myspace friend sent this to me today...damn this is nice. Bad props to this guy.
--------------------------------
Here's an uptempo set, it's not finished yet. I trigger drumkits within Ableton Live with the M-Audio trigger finger, I record the drums into an empty clip slot and then add layers of sound on top of the drums. I also use the crossfader within Live which is assigned to a number of tracks ...very cool feature.
http://www.youtube.com/watch?v=-m5ZlWziIeA
--------------------------------
Here's an uptempo set, it's not finished yet. I trigger drumkits within Ableton Live with the M-Audio trigger finger, I record the drums into an empty clip slot and then add layers of sound on top of the drums. I also use the crossfader within Live which is assigned to a number of tracks ...very cool feature.
http://www.youtube.com/watch?v=-m5ZlWziIeA
CastleCops Hit by Another DDOS Attack
Via DarkReading -
Security watchdog site CastleCops is currently under yet another distributed denial-of-service (DDOS) attack. The anti-spam, anti-malware site manned by volunteers has been under siege from waves of botnet traffic since Wednesday.
CastleCops is no stranger to DDOS attacks -- it gets hit regularly, with its most recent attack back in August -- but this one took a different spin on an old trick.
"Typically, attacks involve some sort of HTTP GET, but this one seems to include a POST instead," says Paul Laudanski, founder and administrator for the CastleCops site, who says he first detected the attack on Wednesday morning after noticing some performance problems with the site.
He initially witnessed a rise in the server load and a pattern in the server logs that indicated a DDOS, he says.
The attack hasn’t taken down the site, but is causing occasional connectivity problems for visitors. "It appears we’ve attracted some fresh bots, too," Laudanski says.
"Apache has been saturated a few times already, necessitating manual httpd restarts, while ensuring bots are filtered," he says.
CastleCops, like other anti-spam and anti-cybercrime sites including Spamhaus, has been an obvious target for disgruntled bad guys due to its community-based efforts to investigate malware and phishing attacks, as well as its collaboration with other researchers and law enforcement.
"I think the question is: When isn’t CastleCops under DDOS attack? They are constantly being hit," says Alex Eckelberry, CEO of Sunbelt Software .
To mitigate the DDOS attack, CastleCops has been filtering traffic based on the attack fingerprint, according to Laudanski, and posting the offending IP addresses, which has kept the attack from crippling the site. And one member of the CastleCops community noted on the site's message board that the attack indicates that CastleCops has struck a nerve with the dark side.
"We have been rattling a lot of cages lately and to me, this DDOS shows we are on the right track," writes "Ernstl."
Security watchdog site CastleCops is currently under yet another distributed denial-of-service (DDOS) attack. The anti-spam, anti-malware site manned by volunteers has been under siege from waves of botnet traffic since Wednesday.
CastleCops is no stranger to DDOS attacks -- it gets hit regularly, with its most recent attack back in August -- but this one took a different spin on an old trick.
"Typically, attacks involve some sort of HTTP GET, but this one seems to include a POST instead," says Paul Laudanski, founder and administrator for the CastleCops site, who says he first detected the attack on Wednesday morning after noticing some performance problems with the site.
He initially witnessed a rise in the server load and a pattern in the server logs that indicated a DDOS, he says.
The attack hasn’t taken down the site, but is causing occasional connectivity problems for visitors. "It appears we’ve attracted some fresh bots, too," Laudanski says.
"Apache has been saturated a few times already, necessitating manual httpd restarts, while ensuring bots are filtered," he says.
CastleCops, like other anti-spam and anti-cybercrime sites including Spamhaus, has been an obvious target for disgruntled bad guys due to its community-based efforts to investigate malware and phishing attacks, as well as its collaboration with other researchers and law enforcement.
"I think the question is: When isn’t CastleCops under DDOS attack? They are constantly being hit," says Alex Eckelberry, CEO of Sunbelt Software .
To mitigate the DDOS attack, CastleCops has been filtering traffic based on the attack fingerprint, according to Laudanski, and posting the offending IP addresses, which has kept the attack from crippling the site. And one member of the CastleCops community noted on the site's message board that the attack indicates that CastleCops has struck a nerve with the dark side.
"We have been rattling a lot of cages lately and to me, this DDOS shows we are on the right track," writes "Ernstl."
------------------------------
Keep up the good work guys...
Google Turns the Lights Out - For Earth Hour
Google users in the United States will notice today that we "turned the lights out" on the Google.com homepage as a gesture to raise awareness of a worldwide energy conservation effort called Earth Hour. As to why we don't do this permanently - it saves no energy; modern displays use the same amount of power regardless of what they display. However, you can do something to reduce the energy consumption of your home PC by joining the Climate Savers Computing Initiative.
On Saturday, March 29, 2008, Earth Hour invites people around the world to turn off their lights for one hour – from 8:00pm to 9:00pm in their local time zone. On this day, cities around the world, including Copenhagen, Chicago, Melbourne, Dubai, and Tel Aviv, will hold events to acknowledge their commitment to energy conservation.
Given our company's commitment to environmental awareness and energy efficiency, we strongly support the Earth Hour campaign, and have darkened our homepage today to help spread awareness of what we hope will be a highly successful global event.
Friday, March 28, 2008
HTML 5: More Client-Side Storage
Via Sophos Blog (Mar 21, 2008) -
With the recent announcement of the draft specifications for HTML 5 [1,2] has come a fair amount of excitement in the web developer community, particularly as we start seeing more browsers offering support (Firefox 3, Safari 3.1, IE8 for example). So, what does HTML 5 bring to the table and how might this new specification affect web threats (if at all)?
A detailed list of the differences between HTML 4 and HTML 5 specifications can be found here. Unsurprisingly, a lot of the new features are design or document structure oriented, including new elements and attributes that have been long awaited. These provide a number of benefits ranging from better support for embedding video to better data handling in input forms. Somewhat ‘behind the scenes’ is one of the most important new features, which is also the one of most interest from a threat perspective - provision for client-side storage.
Historically something of a bugbear, data storage on the client gets some attention in HTML 5. Simple, structured data can now be stored using sessionStorage and localStorage attributes [3]. Only pages from the same origin, in the same window can access sessionStorage data, whereas localStorage data is designed to be accessed across windows, and between sessions (with the same origin policy applied).
...
For those interested in user-tracking, these new storage attributes are attractive. The specification does include a discussion of steps browsers could take in order to help prevent user-tracking, but it is likely we will see targeted marketing taking advantage of this feature.
This is not where it ends with client-side data storage. HTML 5 also allows for local data storage within SQL databases [4]. Client-side SQL injection attacks - an enticing prospect for the attacker.
Increased provision for client-side storage is likely to have a large impact upon web applications that we use (in particular facilitating their offline use). However, the technologies may in turn significantly broaden the scope for attackers. As ever, users will be reliant upon the browsers to implement the specifications correctly, consistently and with security in mind. One thing is for sure, the attackers will already be investing energy into how some of the new features could be exploited.
With the recent announcement of the draft specifications for HTML 5 [1,2] has come a fair amount of excitement in the web developer community, particularly as we start seeing more browsers offering support (Firefox 3, Safari 3.1, IE8 for example). So, what does HTML 5 bring to the table and how might this new specification affect web threats (if at all)?
A detailed list of the differences between HTML 4 and HTML 5 specifications can be found here. Unsurprisingly, a lot of the new features are design or document structure oriented, including new elements and attributes that have been long awaited. These provide a number of benefits ranging from better support for embedding video to better data handling in input forms. Somewhat ‘behind the scenes’ is one of the most important new features, which is also the one of most interest from a threat perspective - provision for client-side storage.
Historically something of a bugbear, data storage on the client gets some attention in HTML 5. Simple, structured data can now be stored using sessionStorage and localStorage attributes [3]. Only pages from the same origin, in the same window can access sessionStorage data, whereas localStorage data is designed to be accessed across windows, and between sessions (with the same origin policy applied).
...
For those interested in user-tracking, these new storage attributes are attractive. The specification does include a discussion of steps browsers could take in order to help prevent user-tracking, but it is likely we will see targeted marketing taking advantage of this feature.
This is not where it ends with client-side data storage. HTML 5 also allows for local data storage within SQL databases [4]. Client-side SQL injection attacks - an enticing prospect for the attacker.
Increased provision for client-side storage is likely to have a large impact upon web applications that we use (in particular facilitating their offline use). However, the technologies may in turn significantly broaden the scope for attackers. As ever, users will be reliant upon the browsers to implement the specifications correctly, consistently and with security in mind. One thing is for sure, the attackers will already be investing energy into how some of the new features could be exploited.
Electricity Directly from Radiation, Not Heat
Via Newscientist.com -
Materials that directly convert radiation into electricity could produce a new era of spacecraft and even Earth-based vehicles powered by high-powered nuclear batteries, say US researchers.
Electricity is usually made using nuclear power by heating steam to rotate turbines that generate electricity.
But beginning in the 1960s, the US and Soviet Union used thermoelectric materials that convert heat into electricity to power spacecraft using nuclear fission or decaying radioactive material. The Pioneer missions were among those using the latter, "nuclear battery" approach.
Dispensing with the steam and turbines makes those systems smaller and less complicated. But thermoelectric materials have very low efficiency. Now US researchers say they have developed highly efficient materials that can convert the radiation, not heat, from nuclear materials and reactions into electricity.
Materials that directly convert radiation into electricity could produce a new era of spacecraft and even Earth-based vehicles powered by high-powered nuclear batteries, say US researchers.
Electricity is usually made using nuclear power by heating steam to rotate turbines that generate electricity.
But beginning in the 1960s, the US and Soviet Union used thermoelectric materials that convert heat into electricity to power spacecraft using nuclear fission or decaying radioactive material. The Pioneer missions were among those using the latter, "nuclear battery" approach.
Dispensing with the steam and turbines makes those systems smaller and less complicated. But thermoelectric materials have very low efficiency. Now US researchers say they have developed highly efficient materials that can convert the radiation, not heat, from nuclear materials and reactions into electricity.
Thursday, March 27, 2008
GRL @ NYC’s Museum of Modern Art
Via GRL -
Today’s lesson: graf law 101 — How to turn the Museum of Modern Art into a get-out-of-jail-4-free card.
The New York State Penal code says that the accused’s "malicious intent" to damage property constitutes the difference between a fourth degree misdemeanor charge and other more serious misdemeanor and felony charges for criminal mischief (i.e. graffiti). Practically speaking, this demand to prove destructive "intent", makes these judges-turned-curators ask a variation of that dusty, old art-vs-crime question we’ve all heard 1000 times before, but now with some fresh legal relevance:
Graffiti is a crime, but is it misdemeanor art or felony vandalism?
A more pointed way of asking that question:
Does another of our colleagues/friends/family-members get a fine + community service or a felony and 3 - 12 months in Rikers?
Well, don’t sweat it your honor, the GRL and the Museum of Modern Art have made your life a little bit easier.
AVONE, KATSU, 2ESAE, SKI, EROTICA 67, TOOFLY, MUCK, JESONE, NOBODY, JACKEE, LEETO, KEPTS, RESKEW, FAUST, TIE, DONA, DIVA, STAR, CAYPER, NETA, DRO, LUCHA, MAMA, NAX, MADG, LADYKFEVER are all MoMA-certified artistas (if it’s the cops who are asking.). And this aint our opinion… it’s art history.
------------------------
Click the GRL link above for the full video...its the bomb.
PWN to OWN Day Two: First Winner Emerges!
Via Tipping Point DVI Blog -
Congratulations to our first winner of the CanSecWest PWN to OWN contest! At 12:38pm local time, the team of Charlie Miller, Jake Honoroff, and Mark Daniel from Independent Security Evaluators have successfully compromised the Apple MacBook Air, winning the laptop and $10,000 from TippingPoint's Zero Day Initiative. They were able to exploit a brand new 0day vulnerability in Apple's Safari web browser. Coincidentally, Apple has just started to ship Safari to some Windows machines, with its iTunes update service. The vulnerability has been acquired by the Zero Day Initiative, and has been responsibly disclosed to Apple who is now working on the issue. Until Apple releases a patch for this issue, neither we nor the contestants will be giving out any additional information about the vulnerability. You can track the vulnerability on the Zero Day Initiative upcoming advisories page under ZDI-CAN-303.
-------------------------
Looks like Charlie and crew broke down the magic elfin shield that protects Apple computers...lol
Congratulations to our first winner of the CanSecWest PWN to OWN contest! At 12:38pm local time, the team of Charlie Miller, Jake Honoroff, and Mark Daniel from Independent Security Evaluators have successfully compromised the Apple MacBook Air, winning the laptop and $10,000 from TippingPoint's Zero Day Initiative. They were able to exploit a brand new 0day vulnerability in Apple's Safari web browser. Coincidentally, Apple has just started to ship Safari to some Windows machines, with its iTunes update service. The vulnerability has been acquired by the Zero Day Initiative, and has been responsibly disclosed to Apple who is now working on the issue. Until Apple releases a patch for this issue, neither we nor the contestants will be giving out any additional information about the vulnerability. You can track the vulnerability on the Zero Day Initiative upcoming advisories page under ZDI-CAN-303.
-------------------------
Looks like Charlie and crew broke down the magic elfin shield that protects Apple computers...lol
Virtually (In)Secure - Trusting the Hypervisor
VMware researcher Oded Horovitz got an earful when he told a group of security buffs his company's virtualization software was theoretically impenetrable. Speaking at the CanSecWest conference in Vancouver, his hour-long presentation, titled Virtually Secure, included a slide titled "VM Escape" that carried the following bullet point:
"Though impossible by design, the hypervisor can still have implementation vulnerabilities."
It was more than some attendees could bear.
"And the Titanic was unsinkable," Mike Poor, a senior security analyst for IntelGuardians shot back. Other attendees complained that security increasingly looked like an afterthought as VMware continued to add new bells and whistles to its Workstation and ESX Server products - many from third party companies.
"I take strong issue with your saying 'trust the hypervisor' when you're expanding it to run other people's APIs," one attendee, who asked not to be identified, told Horovitz immediately following his talk.
The topic is of supreme importance to the future of security. Researchers already depend on VMware Player and Workstation as a means of protecting their machines when analyzing Trojans and other types of malware. And increasingly, large companies are considering virtualization as a means of insulating their servers against rootkits and other types of malware that can burrow into the deepest recesses of their machines and remain there undetected for months or years.
VMware is increasingly holding out ESX as a safer alternative for enterprise computing. It provides a hypervisor that runs directly on top of the hardware and in turn allows one or more "guest" operating systems to run above. VMware says the hypervisor provides an additional layer of protection that is much more resistant to malware than various operation systems. What's more, the hypervisor can sit below the OSes and perform various tasks such as malware detection and patch monitoring.
If the dissenters sound skeptical that hypervisor is impervious, they have their reasons. Poor said his firm received $1.2m from the Department of Homeland Security to look for ways attackers can penetrate hypervisors and ways security researchers can detect and prevent such escapes. Because the two years worth of research is under lock and key, Poor could only say: "We were successful in all three."
And it was only last month that researchers from Core Security Technologies found a bug in VMware's desktop virtualization applications that in some cases allowed attackers to take complete control of the underlying PC. While the vulnerability didn't affect the hypervisor in ESX, it did demonstrate that the protective layer in related VMware products wasn't always as secure as some researchers assumed.
"I'm thrilled they're taking security seriously," Poor said in an interview. "I'm thrilled they have people like Oded on board, and I'm thrilled that the community has brought security to the forefront of VMware's developers. I'm opposed to blindly trusting anything."--------------------------
Poor is right on the mark.
VMWare is making great progress in raising the bar for hypervisor security, but no security person will allow a vendor to tell them that their product is "unbreakable".
Sorry but Google already has claim to the "Trust us, we aren't evil. Seriously you guys!" statement.
Where there is a will (or a giant load of money), there is a way....
BAA Grounds Heathrow T5 Fingerprinting System
Via The Register UK -
BAA has been forced to suspend plans to fingerprint domestic travellers at the new Heathrow Terminal 5 after confusion over the legality of the scheme.
The suspension of the plan - based around a multi-million biometric system - comes just hours before the building opens to the public tomorrow.
The British Airport Authority (BAA) said this afternoon the scheme would be put on hold until further notice.
The Information Commissioner's Office had raised concerns with BAA that the plan could breach the Data Protection Act.
BAA sent us this statement:
Following a meeting with all relevant parties, including the Information Commissioner and the Border and Immigration Agency, the introduction of fingerprinting for domestic passengers and international passengers transferring onto domestic flights at Heathrow will be temporarily delayed. BAA will be opening Terminal 5 using a photographic identification process during this time which is already in place.
We will be working closely with the Information Commissioner and the Home Office over the next few weeks to agree the best approach going forward.
Heathrow Terminal 5 is not the first in the UK where domestic and international passengers will share a departure lounge. But it is the first UK airport where the operator wanted to fingerprint everybody in a "count them all in, count them all out" process.
The ICO has asked BAA to explain why fingerprinting is needed at all.Wednesday, March 26, 2008
Sony Warns of Possible PlayStation Network Hack
Via Wired -
A vulnerability in the PlayStation Network may have given hackers access to PSN passwords as well as the personal info of the Network's users, Sony revealed earlier today.
A vulnerability in the PlayStation Network may have given hackers access to PSN passwords as well as the personal info of the Network's users, Sony revealed earlier today.
This "unauthorized access" is unlikely, though Sony maintains it is a possibility based on their findings. The company maintains that the loss of vital credit card info is "very unlikely."
Sony says it has since fixed the vulnerability and that players need no longer worry about the dangers of having their PSN account hacked, but it urges players to log into the service. "If you can successfully sign in with your pre-set password, your account is not affected by this incident," Sony states.
Anyone who has an issue logging in or other problems that may be related to this possible information leak should contact Sony's Customer Service Department.
Russians' Personal Data Posted on Free Website
Via DarkReading -
Russian media are reporting the emergence of a Website that offers to deliver the personal information of millions of Russian and Ukrainian users for free over the Internet.
According to a broadcast this morning on Russia Today, a Website of unknown origin is offering data on "millions" of Russian citizens to anyone who registers online. The report did not give the URL of the site.
A reporter who attempted to register for the site received an email promise that he will be sent a password "in a couple of days." This led some experts to conclude that the site might be a simple phishing attack, a hoax created to collect the registrant's personal data.
But the reporter also spoke to a number of users who claim they have been able to access the site and have collected a wide range of personal data on Russian citizens. Russia Today speculates that the data may be a compilation of multiple databases that have been stolen previously and sold on the black market.
The site's operators have effectively hidden their identities, according to the report. The site's URL is registered to an organization in Panama, but the data is hosted on a server in St. Louis, the report states.
Lawyers quoted in the report say the citizens who are affected by the posting could file legal charges, but experts said they are pessimistic about the prospects of punishing the site owners.
"Today there are no international documents that could help solve this situation," said Leyla Neyman, a media lawyer. "The site is in .com, not .ru registration zone. And hardly anything could be done."
Aleksey Sabanov, Russian IT security expert, says he has seen many similar cases. "We now observe a well-organized trade of these databases. One of the main questions is accuracy of the information sold," he said.
Russian media are reporting the emergence of a Website that offers to deliver the personal information of millions of Russian and Ukrainian users for free over the Internet.
According to a broadcast this morning on Russia Today, a Website of unknown origin is offering data on "millions" of Russian citizens to anyone who registers online. The report did not give the URL of the site.
A reporter who attempted to register for the site received an email promise that he will be sent a password "in a couple of days." This led some experts to conclude that the site might be a simple phishing attack, a hoax created to collect the registrant's personal data.
But the reporter also spoke to a number of users who claim they have been able to access the site and have collected a wide range of personal data on Russian citizens. Russia Today speculates that the data may be a compilation of multiple databases that have been stolen previously and sold on the black market.
The site's operators have effectively hidden their identities, according to the report. The site's URL is registered to an organization in Panama, but the data is hosted on a server in St. Louis, the report states.
Lawyers quoted in the report say the citizens who are affected by the posting could file legal charges, but experts said they are pessimistic about the prospects of punishing the site owners.
"Today there are no international documents that could help solve this situation," said Leyla Neyman, a media lawyer. "The site is in .com, not .ru registration zone. And hardly anything could be done."
Aleksey Sabanov, Russian IT security expert, says he has seen many similar cases. "We now observe a well-organized trade of these databases. One of the main questions is accuracy of the information sold," he said.
O'Reilly Books Releases Guide to iPhone Hacking
Via News.com -
If you were wondering whether the iPhone software development kit would end the unofficial third-party development craze, stop wondering.
O'Reilly, one of the most well-known publishers of technology primers for professionals, has released a book on developing applications for a jailbroken iPhone. iPhone Open Application Development, written by Jonathan Zdziarski, was spotted by dozens of iPhone aficionados Tuesday. Chapter 1? "Breaking Into and Setting Up the iPhone."
Zdziarski was among the first hackers to take aim at the iPhone last year in light of Apple's Web-only application policy, and his book is essentially a how-to guide for using the "unofficial" iPhone SDK to create applications. Apple, of course, has started to outline its own vision of how applications should be created for the iPhone, giving developers two options for their projects.
There's a group of developers, of an uncertain size, who feel that Apple's SDK restricts their freedom to develop creative applications for the iPhone. Those folks will likely be all over this book. The book itself appears to be a summation of a lot of the iPhone jailbreaking and development techniques that are easy to find online, but condensed into one handy reference guide.
Once the official SDK is released in June, it will be interesting to watch how unofficial iPhone development progresses. Apple's restrictions have some carrots attached, such as a powerful distribution vehicle in iTunes and the App Store, which will definitely attract those trying to make a living off the iPhone.
But those who are trying to circumvent Apple's restrictions by developing unlocking software, music players, or applications unlikely to sit well with Apple, will need a handbook.
Two Vulnerabilities in Windows Safari 3.1
Via heise-online.co.uk -
Argentinian hacker Juan Pablo Lopez Yacubian has discovered two security vulnerabilities in version 3.1. of Apple's Safari browser, which was released last week. The vulnerabilities can be exploited by attackers to fake page content or possibly to inject malicious code.
Yacubian has posted two demo web pages on Geocities which illustrate the vulnerabilities in version 3.1 (build 525.13) of Safari for Windows. Because Geocities integrates its own HTML code into web pages, the pages will have to be edited a little to remove the Geocities code before the demos will work. In tests, one demo used JavaScript to insert fake content into a page from the Google Argentina website and a ZIP file with a very long filename on the second demo page caused Safari to crash and disappear from the desktop. We were not able to reproduce the bug under Mac OS X using the demo page.
An update to fix the vulnerabilities is not yet available. Until an update is released, users of the Windows version of Safari in particular should therefore avoid following links from emails or on websites to sites which require entry of personal credentials, such as online banking login details.
Skullphone Hijacks Digital Billboards in SoCal (with Money)
Via textually.org -
Just a minor update on this story, information is now coming out the Skullphone paid for the ad....therefore not leet hacking skills were involved.
Southern California is all abuzz the hijacking of digital billboards.
Silenced Majority Portal, reports that last Thursday, 18 year old graffiti artist Skullphone hacked into 10 of ClearChannel's digital billboards in Hollwood, Culver City, and elsewhere around LA, putting up his logo in between the more normal ads.
According to SuperTouch Blog, "Hacking into the billboard’s computer network today, Skullphone positioned his trademark imagery in between the array of flashing movie, TV, and auto company ads that make up the normal paid advertising barrage on the giant illuminated monitors."
More images here. Skullphone's profile on MySpace.
----------------------
UPDATE (3:47pm)Just a minor update on this story, information is now coming out the Skullphone paid for the ad....therefore not leet hacking skills were involved.
Tuesday, March 25, 2008
Supreme Court Backs Texas in Dispute with President Bush
Via USAToday.com -
WASHINGTON — Rebuffing President Bush's assertion of his power over foreign affairs, the Supreme Court ruled Tuesday that Texas and other states need not provide new hearings to Mexican citizens on death row who were not told they could obtain consular help when arrested.
The court spurned an appeal by Jose Medellin, who was sentenced to die for the 1993 rape and strangling of two teenage girls who stumbled into a gang initiation in Texas as they walked home from a friend's house.
WASHINGTON — Rebuffing President Bush's assertion of his power over foreign affairs, the Supreme Court ruled Tuesday that Texas and other states need not provide new hearings to Mexican citizens on death row who were not told they could obtain consular help when arrested.
The court spurned an appeal by Jose Medellin, who was sentenced to die for the 1993 rape and strangling of two teenage girls who stumbled into a gang initiation in Texas as they walked home from a friend's house.
By a 6-3 vote, the court said that neither a 2004 decision by the International Court of Justice nor a memorandum by President Bush overrides Texas authority to deny Medellin another hearing. The International Court of Justice had ruled in 2004 that Medellin and 50 other Mexican nationals on state death rows deserved review of their cases because they had not been advised of their consular rights under the Vienna Convention.
Bush had issued a memorandum declaring that states had to abide by the decision.
In Tuesday's decision written by Chief Justice John Roberts, the high court sternly rejected Bush's view that U.S. compliance with IJC decisions rests with the executive branch. The court said the president may not "pre-empt" state law.
Roberts said ICJ's decision interpreting the United States' obligation under the Vienna Convention constitutes an international law obligation. But he stressed, "Not all international law obligations automatically constitute binding federal law enforceable in United States courts."
The court said the president could not, without action by Congress, enforce the IJC judgment on the states.
Donald Francis Donovan, a lawyer for Medellin, said in a statement that he was disappointed with the high court's ruling but noted that the justices said Congress could act to ensure enforcement of the ICJ decision. There was no immediate reaction from the Bush administration.
Because of the international implications and because the case pit Bush against his home state of Texas, the dispute of Medellin v. Texas had been closely watched. Nine states that use capital punishment have Mexican nationals on the death rows; Texas has the most: 15 Mexican nationals.
Medellin did not raise his claim related to his Vienna Convention rights until after his conviction and sentence had become final. Texas judges said he was barred from raising it in later appeals. The Texas Court of Criminal Appeals had ruled most recently that neither the 2004 ICJ decision nor Bush's memo was binding federal law that could override state rules.
After Medellin appealed to the Supreme Court, supported by Bush's memo interpreting the ICJ ruling, Texas officials said Bush's directive infringed on state power. They said if the president wanted the states to comply with the ruling he should have gone to Congress for legislation.
Joining Roberts in siding with Texas were Justices Antonin Scalia, Anthony Kennedy, Clarence Thomas and Samuel Alito. Justice John Paul Stevens concurred in the bottom-line judgment against Medellin. Disenting were Justices Stephen Breyer, David Souter and Ruth Bader Ginsburg.
Security Lapse Exposes Facebook Photos
Via SFGate -
A security lapse made it possible for unwelcome strangers to peruse personal photos posted on Facebook Inc.'s popular online hangout, circumventing a recent upgrade to the Web site's privacy controls.
The Associated Press verified the loophole Monday after receiving a tip from a Byron Ng, a Vancouver, Canada computer technician. Ng began looking for security weaknesses last week after Facebook unveiled more ways for 67 million members to restrict access to their personal profiles.
But the added protections weren't enough to prevent Ng from pulling up the most recent pictures posted by Facebook members and their friends, even if the privacy settings were set to restrict the audience to a select few.
After being alerted Monday afternoon, Facebook spokeswoman Brandee Barker said the Palo Alto-based company fixed the bug within an hour.
"We take privacy very seriously and continue to make enhancements to the site," she said.
The latest lapse serves as another reminder of the perils of sharing sensitive photos and personal information online, even when Web sites pledge to shield the information from prying eyes.
Before the fix, Ng's computer-coding trick enabled him to find private pictures of Paris Hilton at the Emmy awards and of her brother Barron Nicholas drinking a beer with friends and photos of many other people who hadn't granted access to Ng.
Using Ng's template, an AP reporter was able to look up random people on Facebook and see the most recent pictures posted on their personal profiles even if the photos were supposed to be invisible to strangers.
The revealed snapshots showed Italian vacations, office gatherings, holiday parties and college students on spring break. The AP also was able to click through a personal photo album that Facebook co-founder Mark Zuckerberg posted in November 2005.
Some members of social networks like Facebook post photos of themselves or others in potentially embarrassing or compromising situations that include illegal drug use or underage drinking that can cause trouble at school or work. None of the photos reviewed by the AP appeared to fall into this category.
A security lapse made it possible for unwelcome strangers to peruse personal photos posted on Facebook Inc.'s popular online hangout, circumventing a recent upgrade to the Web site's privacy controls.
The Associated Press verified the loophole Monday after receiving a tip from a Byron Ng, a Vancouver, Canada computer technician. Ng began looking for security weaknesses last week after Facebook unveiled more ways for 67 million members to restrict access to their personal profiles.
But the added protections weren't enough to prevent Ng from pulling up the most recent pictures posted by Facebook members and their friends, even if the privacy settings were set to restrict the audience to a select few.
After being alerted Monday afternoon, Facebook spokeswoman Brandee Barker said the Palo Alto-based company fixed the bug within an hour.
"We take privacy very seriously and continue to make enhancements to the site," she said.
The latest lapse serves as another reminder of the perils of sharing sensitive photos and personal information online, even when Web sites pledge to shield the information from prying eyes.
Before the fix, Ng's computer-coding trick enabled him to find private pictures of Paris Hilton at the Emmy awards and of her brother Barron Nicholas drinking a beer with friends and photos of many other people who hadn't granted access to Ng.
Using Ng's template, an AP reporter was able to look up random people on Facebook and see the most recent pictures posted on their personal profiles even if the photos were supposed to be invisible to strangers.
The revealed snapshots showed Italian vacations, office gatherings, holiday parties and college students on spring break. The AP also was able to click through a personal photo album that Facebook co-founder Mark Zuckerberg posted in November 2005.
Some members of social networks like Facebook post photos of themselves or others in potentially embarrassing or compromising situations that include illegal drug use or underage drinking that can cause trouble at school or work. None of the photos reviewed by the AP appeared to fall into this category.
Police ID Fear After Met Website is Hacked
Via Mirror.co.uk -
Cops fear hackers may have stolen the personal details of hundreds of officers.
At first Scotland Yard thought it was just a prank when a picture of Brobee, from children's TV show Yo Gabba Gabb, was posted by hackers on the recruitment website www.metcareers.com last month.
But a security review found the site was linked to two Met databases containing job applications and personal details.
A source said: "This information would be very useful for identity fraudsters and almost priceless to criminals."
---------------------------------
Here was the breaking story on the defacement from last month.
http://djtechnocrat.blogspot.com/2008/02/scotland-yard-careers-website-defaced.html
Replacing a photo is funny, but learning that your web server security has been comprised is not funny. This late reaction shows that this hack wasn't taken very serious.
Sure, it was most likely a kid.....but replace that kid with the RBN and Scotland Yard would have never known their information was stolen.
Basically, that kid's joke might have been their saving grace.
China Calls for 'Patriotic Education' for Tibet Monks
Via Washington Post -
BEIJING, March 25 -- China's security chief called for stepping up "patriotic education" in Tibet's monasteries, the state-run Tibet Daily said Tuesday, as prosecutors for the first time charged demonstrators in the largely peaceful, monk-led protests that later exploded into riots in the region.
Public Security Minister Meng Jianzhu led the first high-level central government visit to Tibet since the riots broke out this month. In the face of international criticism of China's crackdown, he stressed that the government would "fight an active publicity battle" and solicit the help of Communist Party cadres.
His call for broader "patriotic education" indicated the party would also move to exert greater control over religion in Tibet, requiring more Tibetans to accept the region as an inalienable part of China, denounce the Dalai Lama as a separatist and recognize the Chinese-appointed Panchen Lama. Such campaigns were first launched in 1996.
Angered by foreign sympathy for the protesters and support for the Dalai Lama, China is bearing down hard on the exiled Tibetan religious leader, blaming him and his followers for stirring up trouble in an effort to sabotage the Beijing Olympics in August.
The Chinese crackdown has drawn international concern, with some government leaders suggesting a boycott of the opening ceremony of the Games. On Tuesday, when asked about the possibility, French President Nicolas Sarkozy said, "All options are open, and I appeal to the Chinese leaders' sense of responsibility." He added that he had sent a message to Chinese President Hu Jintao noting his concern over the violence.
The European Parliament, whose president has said a boycott should be considered, has scheduled a special debate on the Tibet situation Wednesday in Brussels.
Pentagon Mistakenly Sent Ballistic Missile Fuses to Taiwan
Via FoxNews -
Via NYTimes -
WASHINGTON — The Pentagon has announced that it mistakenly shipped non-nuclear ballistic missile components to Taiwan from a U.S. Air Force base in Wyoming.
It said the items have been returned to the United States.
At a news conference, Air Force Secretary Michael Wynne said Tuesday that the misshipped items were four nose cone assemblies for ballistic missiles. He also said it was sent instead of helicopter batteries that had been ordered by Taiwan, he said.
Wynne said the matter is under investigation.
Ryan Henry, the No. 2 policy official in the office of Defense Secretary Robert Gates, said President Bush was notified of the mistake and the actions to recover the items. Henry called the mistake "disconcerting" and intolerable.
---------------------
UPDATE (3/25/08 3:48pm CST)Via NYTimes -
Instead of sending helicopter batteries, the United States shipped four electrical fuses for Minuteman nuclear missile warheads to Taiwan, a mistake that was discovered only last week — a year and a half after the erroneous shipment, Pentagon officials disclosed on Tuesday.
Officials said the nose-cone fuses contained no nuclear material, and were similar in function to the ones used for conventional munitions, although these were designed specifically to send an electrical signal to the trigger of the MK-12 nuclear warhead as it was approaching the ground.
CanSecWest PWN to OWN 2008
Updated Rules of Enagagment from Tipping Point's ZDI Crew
http://dvlabs.tippingpoint.com/blog/2008/03/19/cansecwest-pwn-to-own-2008
---------------------
In addition, I was told by one of my ZDI pal that Quicktime is now in scape for Day 2 attacks.
Day 2: March 27th: Default client-side apps
The attack surfaces increases to also include any default installed client-side applications which can be exploited by following a link through email, vendor supplied IM client or visiting a malicious website. First one to pwn it receives the laptop and a $10,000 cash prize. The pwned machine(s) will be taken out of the contest at that time.
I noticed last week that this product was absence from the list and was highlighted in at least one media write-up, which got me wondering as well.
Let the games begin...
http://dvlabs.tippingpoint.com/blog/2008/03/19/cansecwest-pwn-to-own-2008
---------------------
In addition, I was told by one of my ZDI pal that Quicktime is now in scape for Day 2 attacks.
Day 2: March 27th: Default client-side apps
The attack surfaces increases to also include any default installed client-side applications which can be exploited by following a link through email, vendor supplied IM client or visiting a malicious website. First one to pwn it receives the laptop and a $10,000 cash prize. The pwned machine(s) will be taken out of the contest at that time.
I noticed last week that this product was absence from the list and was highlighted in at least one media write-up, which got me wondering as well.
Let the games begin...
Monday, March 24, 2008
CSRF Threat Grows Stronger
Via InfoWorld.com -
The latest research report out of Web applications security specialist WhiteHat finds that most sites are still woefully vulnerable to hacker attacks.
Just as in its previous research, WhiteHat estimates that some 90 percent of all pages are hack-able, the same figure that it has attached to several previous reports.
The message? Things aren't getting much better out there!
Over the last two years that WhiteHat has been issuing its paper, the company has reported that the volume and variety of Web site attacks have in fact only continued to rise, with Cross-Site Request Forgery (CSRF) tabbed as the next big thing by the experts this go round.
According to the company, nine out of ten sites still have serious vulnerabilities with an average of seven vulnerabilities per site.
The leading forms of exploit that WhiteHat is observing on the Net haven't budged much in recent months either, with classic techniques including SQL injection, buffer overflows and cross-site scripting (XSS) leading the way. However, the company is predicting that CSRF threats will soon begin to multiply.
Cross-Site Request Forgery (CSRF), as defined by OWASP, is an attack that attempts to fool end users into loading a Web page that contains a malicious request, much like traditional phishing attacks or XSS threats.
Using the technique, hackers then try to misappropriate victims' identities and privileges to carry out activities such as changing their applications passwords to gain entrance to banking sites, or to log into e-commerce sites to make fraudulent purchases in their names. In some cases, the attacks are hidden on the vulnerable sites themselves.
CSRF attacks are also known by a number of other names, including XSRF, Sea Surf, Session Riding, Cross-Site Reference Forgery, and Hostile Linking.
WhiteHat researchers said that attackers using CSRF exploits can "easily" manipulate today's Web browsers to send unintended HTTP requests such as fraudulent wire transfers, change passwords and download illegal content.
And based on its research, the company said that CSRF attacks will eventually move into the number two spot behind XSS exploits in terms of its frequency among the leading site hacking techniques.
The latest research report out of Web applications security specialist WhiteHat finds that most sites are still woefully vulnerable to hacker attacks.
Just as in its previous research, WhiteHat estimates that some 90 percent of all pages are hack-able, the same figure that it has attached to several previous reports.
The message? Things aren't getting much better out there!
Over the last two years that WhiteHat has been issuing its paper, the company has reported that the volume and variety of Web site attacks have in fact only continued to rise, with Cross-Site Request Forgery (CSRF) tabbed as the next big thing by the experts this go round.
According to the company, nine out of ten sites still have serious vulnerabilities with an average of seven vulnerabilities per site.
The leading forms of exploit that WhiteHat is observing on the Net haven't budged much in recent months either, with classic techniques including SQL injection, buffer overflows and cross-site scripting (XSS) leading the way. However, the company is predicting that CSRF threats will soon begin to multiply.
Cross-Site Request Forgery (CSRF), as defined by OWASP, is an attack that attempts to fool end users into loading a Web page that contains a malicious request, much like traditional phishing attacks or XSS threats.
Using the technique, hackers then try to misappropriate victims' identities and privileges to carry out activities such as changing their applications passwords to gain entrance to banking sites, or to log into e-commerce sites to make fraudulent purchases in their names. In some cases, the attacks are hidden on the vulnerable sites themselves.
CSRF attacks are also known by a number of other names, including XSRF, Sea Surf, Session Riding, Cross-Site Reference Forgery, and Hostile Linking.
WhiteHat researchers said that attackers using CSRF exploits can "easily" manipulate today's Web browsers to send unintended HTTP requests such as fraudulent wire transfers, change passwords and download illegal content.
And based on its research, the company said that CSRF attacks will eventually move into the number two spot behind XSS exploits in terms of its frequency among the leading site hacking techniques.
iBooter Firmware Console Released for iPhone
Via arstechnica.com -
As you've probably noticed, the number of big iPhone jailbreak/hack releases we cover has been gradually decreasing over the past few months as development has settled down. That's not to say that there aren't some great iPhone hacking utilities being released, though. One such hack is iBooter, a tool for interactively communicating with the iBoot bootloader on the iPhone an iPod touch.
iBooter certainly isn't as mainstream a tool as the jailbreak and unlock applications, but it should come in handy for a number of people. Basically, iBooter will let you talk directly to the iPhone bootloader and tinker with it, allowing you to customize your iPhone in a few ways, and also diagnose any booting problems. Normally, you can only send commands to the bootloader, but this new utility will let you get replies back as well, making it an improvement over previous tools. Perhaps more importantly, iBooter works on Windows, Linux, and OS X, and doesn't require iTunes to be installed (as similar tools do). It has a lot of commands that will be useful for developers, or for anyone who's interested in the inner workings of their iPhone, so give it a whirl if you're curious.
As you've probably noticed, the number of big iPhone jailbreak/hack releases we cover has been gradually decreasing over the past few months as development has settled down. That's not to say that there aren't some great iPhone hacking utilities being released, though. One such hack is iBooter, a tool for interactively communicating with the iBoot bootloader on the iPhone an iPod touch.
iBooter certainly isn't as mainstream a tool as the jailbreak and unlock applications, but it should come in handy for a number of people. Basically, iBooter will let you talk directly to the iPhone bootloader and tinker with it, allowing you to customize your iPhone in a few ways, and also diagnose any booting problems. Normally, you can only send commands to the bootloader, but this new utility will let you get replies back as well, making it an improvement over previous tools. Perhaps more importantly, iBooter works on Windows, Linux, and OS X, and doesn't require iTunes to be installed (as similar tools do). It has a lot of commands that will be useful for developers, or for anyone who's interested in the inner workings of their iPhone, so give it a whirl if you're curious.
Terrorism Money is Still Flowing
Via LATimes.com -
WASHINGTON -- The U.S.-led effort to choke off financing for Al Qaeda and other terrorist groups is foundering because setbacks at home and abroad have undermined the Bush administration's highly touted counter-terrorism weapon, according to current and former officials and independent experts.
In some cases, extremist groups have blunted financial anti-terrorism tools by finding new ways to raise, transfer and spend their money. In other cases, the administration has stumbled over legal difficulties and interagency fighting, officials and experts say.
But the most serious problems are fractures and mistrust within the coalition of nations that the United States admits it needs to target financiers of terrorism and to stanch the flow of funding from wealthy donors to extremist causes.
"The international cooperation and focus is dropping, the farther we get from 9/11," said Michael Jacobson, who was a senior advisor in the Treasury Department's Office of Terrorism and Financial Intelligence until March 2007. "Some countries lack political will. Others just don't have the basic capacity to govern their countries, much less create a viable financial intelligence unit."
Many current and former officials and experts say that because of political, legal, cultural and technical problems, the administration-led coalition is deteriorating.
"Al Qaeda, the Taliban and other terrorist groups continue to have access to the funds they need for active and expanded indoctrination, recruitment, maintenance, armament and operations," said Victor D. Comras, a former United Nations terrorism finance official.
Internationally, the sense of urgency over terrorism financing has waned since the 2001 attacks. As political climates have changed and negative perceptions of the United States have risen, key allies are cooperating less, current and former officials say.
In the Middle East and elsewhere, many countries have resisted U.S. pressure to investigate and identify financiers.
Saudi Arabia, Pakistan and other key nations have not taken the necessary steps to crack down on terrorist financing or suspect money flowing across their borders. Other countries, including Afghanistan and some African nations, lack the financial infrastructure to cooperate meaningfully.
Also, the most deadly terrorist attacks since Sept. 11, 2001, have cost so little -- often less than $10,000 -- that they are virtually impossible to detect by following a money trail.
Terrorist networks need larger sums to travel, train operatives, bribe government officials, evade capture and expand support bases. Increasingly, however, they are moving funds below the radar of U.S.-led enforcement and intelligence-gathering efforts, officials and experts said.
Cash couriers use donkeys and camels in places like Pakistan and Afghanistan, for instance, and private jets are used in oil-rich Persian Gulf kingdoms to move cash, gold and jewels. The networks continue to rely on a centuries-old informal banking system known as hawala, which leaves virtually no trail.
Overall, it is nearly impossible to distinguish funds meant for potential terrorism from legitimate transactions, said a senior State Department official, who, like some of the those interviewed, spoke on condition of anonymity because of prohibitions against commenting on the record on counter-terrorism.
Current and former U.S. officials acknowledge they are struggling, especially because much-needed allies are unwilling or unable to assist.
"It's not as much that we're not properly executing our strategy," said Robert Grenier, a former senior CIA official. "It's that the strategy is of limited utility in countering terrorism financing given the mechanisms that terrorists use."
-----------------------
In my mind, tracing terrorism money is less about stopping a specific attack and more about bring to light the terrorist organization as a whole entity.
If we understand their money making techniques, their common money laundering channels, then we can build a much better overall picture of the organizational nature of these groups.
Thus allowing those that fight their organizations to find the weak link in the system.
Following the money trail is a very important piece of the terrorism research puzzle, but it is just that...only a piece.
WASHINGTON -- The U.S.-led effort to choke off financing for Al Qaeda and other terrorist groups is foundering because setbacks at home and abroad have undermined the Bush administration's highly touted counter-terrorism weapon, according to current and former officials and independent experts.
In some cases, extremist groups have blunted financial anti-terrorism tools by finding new ways to raise, transfer and spend their money. In other cases, the administration has stumbled over legal difficulties and interagency fighting, officials and experts say.
But the most serious problems are fractures and mistrust within the coalition of nations that the United States admits it needs to target financiers of terrorism and to stanch the flow of funding from wealthy donors to extremist causes.
"The international cooperation and focus is dropping, the farther we get from 9/11," said Michael Jacobson, who was a senior advisor in the Treasury Department's Office of Terrorism and Financial Intelligence until March 2007. "Some countries lack political will. Others just don't have the basic capacity to govern their countries, much less create a viable financial intelligence unit."
Many current and former officials and experts say that because of political, legal, cultural and technical problems, the administration-led coalition is deteriorating.
"Al Qaeda, the Taliban and other terrorist groups continue to have access to the funds they need for active and expanded indoctrination, recruitment, maintenance, armament and operations," said Victor D. Comras, a former United Nations terrorism finance official.
Internationally, the sense of urgency over terrorism financing has waned since the 2001 attacks. As political climates have changed and negative perceptions of the United States have risen, key allies are cooperating less, current and former officials say.
In the Middle East and elsewhere, many countries have resisted U.S. pressure to investigate and identify financiers.
Saudi Arabia, Pakistan and other key nations have not taken the necessary steps to crack down on terrorist financing or suspect money flowing across their borders. Other countries, including Afghanistan and some African nations, lack the financial infrastructure to cooperate meaningfully.
Also, the most deadly terrorist attacks since Sept. 11, 2001, have cost so little -- often less than $10,000 -- that they are virtually impossible to detect by following a money trail.
Terrorist networks need larger sums to travel, train operatives, bribe government officials, evade capture and expand support bases. Increasingly, however, they are moving funds below the radar of U.S.-led enforcement and intelligence-gathering efforts, officials and experts said.
Cash couriers use donkeys and camels in places like Pakistan and Afghanistan, for instance, and private jets are used in oil-rich Persian Gulf kingdoms to move cash, gold and jewels. The networks continue to rely on a centuries-old informal banking system known as hawala, which leaves virtually no trail.
Overall, it is nearly impossible to distinguish funds meant for potential terrorism from legitimate transactions, said a senior State Department official, who, like some of the those interviewed, spoke on condition of anonymity because of prohibitions against commenting on the record on counter-terrorism.
Current and former U.S. officials acknowledge they are struggling, especially because much-needed allies are unwilling or unable to assist.
"It's not as much that we're not properly executing our strategy," said Robert Grenier, a former senior CIA official. "It's that the strategy is of limited utility in countering terrorism financing given the mechanisms that terrorists use."
-----------------------
In my mind, tracing terrorism money is less about stopping a specific attack and more about bring to light the terrorist organization as a whole entity.
If we understand their money making techniques, their common money laundering channels, then we can build a much better overall picture of the organizational nature of these groups.
Thus allowing those that fight their organizations to find the weak link in the system.
Following the money trail is a very important piece of the terrorism research puzzle, but it is just that...only a piece.
Engineer Gets 24 1/2 Years in Prison
Via Philly.com -
SANTA ANA, Calif. - A Chinese-born engineer convicted of conspiracy to export U.S. defense technology to China was sentenced Monday to 24 1/2 years in federal prison.
Chi Mak, 67, was also convicted last year of acting as an unregistered foreign agent, attempting to violate export control laws and making false statements to the FBI.
He worked on highly sensitive submarine propulsion systems in his job as an engineer for the Anaheim-based naval defense contractor Power Paragon.
Mak was arrested in late 2005 in Los Angeles after FBI agents stopped his brother and sister-in-law as they boarded a flight to Hong Kong and Guangzhou, China.
Investigators said they found three encrypted CDs in their luggage that contained documents on a submarine propulsion system, a solid-state power switch for ships and a PowerPoint presentation on the future of power electronics.
Mak sought a new trial earlier this year, but a judge rejected the request.
Medicine's Cutting Edge: Re-Growing Organs
Via CBSNews -
Three years ago, Lee Spievack sliced off the tip of his finger in the propeller of a hobby shop airplane.
What happened next, Andrews reports, propelled him into the future of medicine. Spievack's brother, Alan, a medical research scientist, sent him a special powder and told him to sprinkle it on the wound.
"I powdered it on until it was covered," Spievack recalled.
To his astonishment, every bit of his fingertip grew back.
"Your finger grew back," Andrews asked Spievack, "flesh, blood, vessels and nail?"
"Four weeks," he answered.
Andrews spoke to Dr. Steven Badylak of the University of Pittsburgh's McGowan Institute of Regenerative Medicine and asked if that powder was the reason behind Spievack's new finger tip.
"Yes, it is," Badylak explained. "We took this and turned it into a powdered form."
That powder is a substance made from pig bladders called extracellular matrix. It is a mix of protein and connective tissue surgeons often use to repair tendons and it holds some of the secrets behind the emerging new science of regenerative medicine.
"It tells the body, start that process of tissue regrowth," said Badylak.
Badlayk is one of the many scientists who now believe every tissue in the body has cells which are capable of regeneration. All scientists have to do is find enough of those cells and "direct" them to grow.
"Somehow the matrix summons the cells and tell them what to do," Badylak explained. "It helps instruct them in terms of where they need to go, how they need to differentiate - should I become a blood vessel, a nerve, a muscle cell or whatever."
If this helped Spievack's finger regrow, Badylak says, at least in theory, you should be able to grow a whole limb.
...
Dr. Atala, one of the pioneers of regeneration, believes every type of tissue already has cells ready to regenerate if only researchers can prod them into action. Sometimes that prodding can look like science fiction.
Emerging from an everyday ink jet printer is the heart of a mouse. Mouse heart cells go into the ink cartridge and are then sprayed down in a heart shaped pattern layer by layer.
Dr. Atala believes it's a matter of time before someone grows a human heart.
"The cells have all the genetic information necessary to make new tissue," Atala explained. "That's what they are programmed to do. So your heart cells are programmed to make more heart tissue, your bladder cells are programmed to make more bladder cells."
Atala's work with human bladder cells has pushed regenerative medicine to a transformational breakthrough.
In this clinical trial at Thomas Jefferson Hospital in Philadelphia, Dr. Patrick Shenot is performing a bladder transplant with an organ built with this patient's own cells. In a process developed by Dr. Atala, the patient's cells were grown in a lab, and then seeded on a biodegradable bladder-shaped scaffold.
Eight weeks later, with the scaffold now infused with millions of regrown cells, it is transplanted into the patient. When the scaffold dissolves, Dr. Shenot says what's left will be a new, functioning organ.
"The cells will differentiate into the two major cells in the bladder wall, the muscle cells and the lining cells," he explained. "It's very much the future, but it's today. We are doing this today."
-----------------------
Holy crap, this is crazy technosorcery my friends...but I love it.
Three years ago, Lee Spievack sliced off the tip of his finger in the propeller of a hobby shop airplane.
What happened next, Andrews reports, propelled him into the future of medicine. Spievack's brother, Alan, a medical research scientist, sent him a special powder and told him to sprinkle it on the wound.
"I powdered it on until it was covered," Spievack recalled.
To his astonishment, every bit of his fingertip grew back.
"Your finger grew back," Andrews asked Spievack, "flesh, blood, vessels and nail?"
"Four weeks," he answered.
Andrews spoke to Dr. Steven Badylak of the University of Pittsburgh's McGowan Institute of Regenerative Medicine and asked if that powder was the reason behind Spievack's new finger tip.
"Yes, it is," Badylak explained. "We took this and turned it into a powdered form."
That powder is a substance made from pig bladders called extracellular matrix. It is a mix of protein and connective tissue surgeons often use to repair tendons and it holds some of the secrets behind the emerging new science of regenerative medicine.
"It tells the body, start that process of tissue regrowth," said Badylak.
Badlayk is one of the many scientists who now believe every tissue in the body has cells which are capable of regeneration. All scientists have to do is find enough of those cells and "direct" them to grow.
"Somehow the matrix summons the cells and tell them what to do," Badylak explained. "It helps instruct them in terms of where they need to go, how they need to differentiate - should I become a blood vessel, a nerve, a muscle cell or whatever."
If this helped Spievack's finger regrow, Badylak says, at least in theory, you should be able to grow a whole limb.
...
Dr. Atala, one of the pioneers of regeneration, believes every type of tissue already has cells ready to regenerate if only researchers can prod them into action. Sometimes that prodding can look like science fiction.
Emerging from an everyday ink jet printer is the heart of a mouse. Mouse heart cells go into the ink cartridge and are then sprayed down in a heart shaped pattern layer by layer.
Dr. Atala believes it's a matter of time before someone grows a human heart.
"The cells have all the genetic information necessary to make new tissue," Atala explained. "That's what they are programmed to do. So your heart cells are programmed to make more heart tissue, your bladder cells are programmed to make more bladder cells."
Atala's work with human bladder cells has pushed regenerative medicine to a transformational breakthrough.
In this clinical trial at Thomas Jefferson Hospital in Philadelphia, Dr. Patrick Shenot is performing a bladder transplant with an organ built with this patient's own cells. In a process developed by Dr. Atala, the patient's cells were grown in a lab, and then seeded on a biodegradable bladder-shaped scaffold.
Eight weeks later, with the scaffold now infused with millions of regrown cells, it is transplanted into the patient. When the scaffold dissolves, Dr. Shenot says what's left will be a new, functioning organ.
"The cells will differentiate into the two major cells in the bladder wall, the muscle cells and the lining cells," he explained. "It's very much the future, but it's today. We are doing this today."
-----------------------
Holy crap, this is crazy technosorcery my friends...but I love it.
Shooting Flying Cars with Machine Guns, Rocket Launchers
Via gizmodo.com -
I'm on the beach on semi-vacation now, here in the south of Spain, and we have BBC One via satellite. This means one thing on Sunday nights: Top Gear. Chances are that you probably have watched Top Gear clips on YouTube, like the one above, in which Jeremy Clarkson replaces clay pigeons and shotguns with real flying cars, machine guns and, at the end of it, a gas-tank-seeking (no kidding) rocket launcher.
-----------------------------
Heres the video.
http://view.break.com/175421
I'm on the beach on semi-vacation now, here in the south of Spain, and we have BBC One via satellite. This means one thing on Sunday nights: Top Gear. Chances are that you probably have watched Top Gear clips on YouTube, like the one above, in which Jeremy Clarkson replaces clay pigeons and shotguns with real flying cars, machine guns and, at the end of it, a gas-tank-seeking (no kidding) rocket launcher.
-----------------------------
Heres the video.
http://view.break.com/175421
Comcast Wants to Watch You with DVR Cams
Via PCWorld -
In a scene straight out of 1984, Comcast said it will begin placing actual cameras in DVR units to track data for who is watching the digital television.
This statement is so farfetched I almost don't believe it, but it came out of the mouth of Gerard Kunkel, the senior vice president of user experience for Comcast. At the Digital Living Room conference he said that Comcast is already experimenting embedding cameras into DVR boxes that actually watch the television watchers. Big Brother, anyone?
Comcast is shilling this as a type of customization features. The camera would be capable of recognizing specific individuals and therefore loading a user's favorite channels and on the other hand block certain content as well. Stop the schtick, Comcast. Nobody, and I mean nobody would ever voluntarily allow you to place a camera in a household, for any purpose. It's a shame that I can already imagine the headlines when Comcast does this involuntarily.
----------------------
Screw that, count me out...
In a scene straight out of 1984, Comcast said it will begin placing actual cameras in DVR units to track data for who is watching the digital television.
This statement is so farfetched I almost don't believe it, but it came out of the mouth of Gerard Kunkel, the senior vice president of user experience for Comcast. At the Digital Living Room conference he said that Comcast is already experimenting embedding cameras into DVR boxes that actually watch the television watchers. Big Brother, anyone?
Comcast is shilling this as a type of customization features. The camera would be capable of recognizing specific individuals and therefore loading a user's favorite channels and on the other hand block certain content as well. Stop the schtick, Comcast. Nobody, and I mean nobody would ever voluntarily allow you to place a camera in a household, for any purpose. It's a shame that I can already imagine the headlines when Comcast does this involuntarily.
----------------------
Screw that, count me out...
Pilot's Gun Discharges on US Airways Flight
Via wcnc.com (Carolinas' Local News) -
CHARLOTTE, N.C.-- A US Airways pilot’s gun accidentally discharged during a flight from Denver to Charlotte Saturday, according to a statement released by the airline.
The statement said the discharge happened on Flight 1536, which left Denver at approximately 6:45 a.m. and arrived in Charlotte at approximately 11:51 a.m.
The Airbus A319 plane landed safely and none of the flight’s 124 passengers or five crew members was injured, according to the statement. It was a full flight. An airline spokeswoman said the plane has been taken out of service to make sure it is safe to return to flight.
A Transportation Safety Administration spokeswoman reached by WCNC Sunday said the pilot is part of TSA’s Federal Flight Deck Officer (FFDO) program, which trains pilots to carry guns on flights. Andrea McCauley said the gun discharged in the cockpit, but she could not release how the gun was being transported at the time. She did not release the pilot’s name, but said he was authorized to carry the weapon and was last requalified in the FFDO program last November.
A statement from TSA said the airplane was never in danger, and the TSA and the Federal Air Marshals Service are investigating the incident.
----------------------------
I'm glad the TSA is worried about the plane...but what about the people, they WERE clearly in danger.Sunday, March 23, 2008
Ohio Outsourcing: Tata The Latest Indian IT Company Hiring In The U.S.
Via InformationWeek -
India's IT service providers want to prove they can innovate--not just serve up low-cost talent--but that's proving a difficult task from the other side of the globe. One solution: They're hiring more U.S. talent.
Tata Consultancy Services said last week it has opened a development center in a former paper plant outside Cincinnati, with initial plans to employ 1,000 people, which would make it one of the largest U.S. development centers by an India-based IT services company. The 200,000-square-foot facility will include a lab where TCS hopes to show off its experience in such areas as industrial engineering and services. TCS plans to hire Midwest tech talent for the facility.
It's similar to plans by Wipro Technologies, which in August acquired U.S. infrastructure management vendor InfoCrossing, with 900 employees, for $600 million. Wipro is recruiting about 500 people, largely recent college grads, for a new Atlanta development center, and it plans two more centers with staffing of up to 500 people each in to-be-announced U.S. cities. Wipro's also set up a center outside Detroit.
Indian IT companies also are buying small consulting companies, looking to add regional and industry experience. Satyam Computer paid $35 million in January for Chicago-based Bridge Strategy Group, a firm of 36 management consultants. Infosys also is doing select hiring in the United States, particularly for consulting. None of these add up to a big chunk of the workforce for Indian IT vendors; TCS, for example, has more than 100,000 employees, about 10% of whom are not Indian.
But companies believe they need more people close to the customer to work on innovation efforts such as process change and new product rollouts. "Globalization of our delivery model is something we're doing at a very aggressive pace," says N.S. Bala, Wipro's senior VP of manufacturing solutions.
A bigger U.S. presence also makes Indian providers a more viable option for companies that don't want to send sensitive data or product development offshore.
---------------
Am I the only one that thinks this is just strange?
India's IT service providers want to prove they can innovate--not just serve up low-cost talent--but that's proving a difficult task from the other side of the globe. One solution: They're hiring more U.S. talent.
Tata Consultancy Services said last week it has opened a development center in a former paper plant outside Cincinnati, with initial plans to employ 1,000 people, which would make it one of the largest U.S. development centers by an India-based IT services company. The 200,000-square-foot facility will include a lab where TCS hopes to show off its experience in such areas as industrial engineering and services. TCS plans to hire Midwest tech talent for the facility.
It's similar to plans by Wipro Technologies, which in August acquired U.S. infrastructure management vendor InfoCrossing, with 900 employees, for $600 million. Wipro is recruiting about 500 people, largely recent college grads, for a new Atlanta development center, and it plans two more centers with staffing of up to 500 people each in to-be-announced U.S. cities. Wipro's also set up a center outside Detroit.
Indian IT companies also are buying small consulting companies, looking to add regional and industry experience. Satyam Computer paid $35 million in January for Chicago-based Bridge Strategy Group, a firm of 36 management consultants. Infosys also is doing select hiring in the United States, particularly for consulting. None of these add up to a big chunk of the workforce for Indian IT vendors; TCS, for example, has more than 100,000 employees, about 10% of whom are not Indian.
But companies believe they need more people close to the customer to work on innovation efforts such as process change and new product rollouts. "Globalization of our delivery model is something we're doing at a very aggressive pace," says N.S. Bala, Wipro's senior VP of manufacturing solutions.
A bigger U.S. presence also makes Indian providers a more viable option for companies that don't want to send sensitive data or product development offshore.
---------------
Am I the only one that thinks this is just strange?
Microsoft Building Searched By Feds Investigating High-Priced Hookers
Via InformationWeek -
Federal investigators executed a search warrant at Microsoft (NSDQ: MSFT)'s Mountain View, Calif., offices earlier this month as part of an investigation into a high-priced call girl ring similar to the one used by former New York Gov. Eliot Spitzer. Court records show that that an Internal Revenue Service agent carried out the search order at Building 4 of Microsoft's Mountain View campus on March 4.
The investigator, IRS special agent Anthony Romero, was seeking the Microsoft Hotmail account records of a woman accused of involvement in a pricey escort service operating out of Denver, Colo. Records show that Romero seized from Microsoft more than 3,000 files of "preserved data" from the account of Kitty_Crimson@hotmail.com.
Authorities believe that "Kitty Crimson" is actually Heather Bruck, a Denver-area woman who allegedly worked as a prostitute for an escort service that went by the names Denver Sugar and Denver Players, according to court papers.
The ring, which charged clients upwards of $400 an hour for sex, catered to prominent and wealthy Denver residents, including businessmen and professional athletes, according to local media reports.
Denver's Rocky Mountain News last week reported that the chief judge of the U.S. District Court for Colorado, Edward Nottingham, has also been identified as one of the escort service's customers.
Federal investigators executed a search warrant at Microsoft (NSDQ: MSFT)'s Mountain View, Calif., offices earlier this month as part of an investigation into a high-priced call girl ring similar to the one used by former New York Gov. Eliot Spitzer. Court records show that that an Internal Revenue Service agent carried out the search order at Building 4 of Microsoft's Mountain View campus on March 4.
The investigator, IRS special agent Anthony Romero, was seeking the Microsoft Hotmail account records of a woman accused of involvement in a pricey escort service operating out of Denver, Colo. Records show that Romero seized from Microsoft more than 3,000 files of "preserved data" from the account of Kitty_Crimson@hotmail.com.
Authorities believe that "Kitty Crimson" is actually Heather Bruck, a Denver-area woman who allegedly worked as a prostitute for an escort service that went by the names Denver Sugar and Denver Players, according to court papers.
The ring, which charged clients upwards of $400 an hour for sex, catered to prominent and wealthy Denver residents, including businessmen and professional athletes, according to local media reports.
Denver's Rocky Mountain News last week reported that the chief judge of the U.S. District Court for Colorado, Edward Nottingham, has also been identified as one of the escort service's customers.
Giant Cupcake Seats
What do you get when you take a giant cupcake, and add chocolate frosting made out of molded rubber? Easy...it's the Jellio Cupcake Seat...guaranteed to generate instant laughter in any room. Use it as a seat, an ottoman or just an incredibly cool conversation piece. Adults love them for the fun they bring to any room, and kids love them because...well, because they're giant cupcakes, silly. A Jellio Exclusive.
http://www.jellio.com/store/cupcakeseat.html
--------------------
freaking sweet...
http://www.jellio.com/store/cupcakeseat.html
--------------------
freaking sweet...
Love It or Hate It, In-Flight Cellphone Use Has Arrived
Via Wired.com -
Say goodbye to one of the last remaining phone-free havens.
Emirates Airlines is outfitting its planes with technology that will allow passengers to use their mobile phones in flight. The system went into effect for the first time this week on an Airbus A340 flight between Dubai and Casablanca. Emirates is partnering on the project with AeroMobile, which has developed technology that allows cellular phones to work at a low-enough level that they don't risk interfering with a plane's other systems. Emirates is shelling out $27 million to roll the system out fleetwide.
Perhaps hoping to allay passenger fears about being stuck next to a cellphone-wielding Chatty Charlie on a 13-hour flight to Tokyo, Emirates says passengers will only be allowed to make five or six calls per flight. And they point out that flight crews will have the power to turn the system on and off as needed, making it less likely that the woman sitting in 26D is able to initiate a conference call at 3 in the morning. Plus, the airline will ask all passengers to switch their phones to silent or vibrate when they board. Which is great, because, you know, that works really well at the movies.
The airlines have been threatening to do this for years. American Airlines has tested technology developed by Qualcomm, and Air France and bmi have also experimented with the in-flight calls.
Depending on your point of view, this is either a great step forward, or just another reason to dread boarding an airplane.
----------------------------------
I still think this is a horrible idea.
Just think about those bluetooth phone users that are basically talking aloud on the phone, add in plane noise..and we will now have at least 10 people yelling on the plane at once.
F'in great idea eh?
Say goodbye to one of the last remaining phone-free havens.
Emirates Airlines is outfitting its planes with technology that will allow passengers to use their mobile phones in flight. The system went into effect for the first time this week on an Airbus A340 flight between Dubai and Casablanca. Emirates is partnering on the project with AeroMobile, which has developed technology that allows cellular phones to work at a low-enough level that they don't risk interfering with a plane's other systems. Emirates is shelling out $27 million to roll the system out fleetwide.
Perhaps hoping to allay passenger fears about being stuck next to a cellphone-wielding Chatty Charlie on a 13-hour flight to Tokyo, Emirates says passengers will only be allowed to make five or six calls per flight. And they point out that flight crews will have the power to turn the system on and off as needed, making it less likely that the woman sitting in 26D is able to initiate a conference call at 3 in the morning. Plus, the airline will ask all passengers to switch their phones to silent or vibrate when they board. Which is great, because, you know, that works really well at the movies.
The airlines have been threatening to do this for years. American Airlines has tested technology developed by Qualcomm, and Air France and bmi have also experimented with the in-flight calls.
Depending on your point of view, this is either a great step forward, or just another reason to dread boarding an airplane.
----------------------------------
I still think this is a horrible idea.
Just think about those bluetooth phone users that are basically talking aloud on the phone, add in plane noise..and we will now have at least 10 people yelling on the plane at once.
F'in great idea eh?
Whitepaper: Firewire Hack on Windows Vista
This paper from the SEC Consult vulnerability lab describes how the fireware hack can be applied to Windows Vista. By overwriting certain memory regions using the firewire DMA feature, password authentication under Vista can be deactivated.
SEC Consult Whitepaper
http://www.sec-consult.com/fileadmin/Whitepapers/Vista_Physical_Attacks.pdf
SEC Consult Whitepaper
http://www.sec-consult.com/fileadmin/Whitepapers/Vista_Physical_Attacks.pdf
PM Candidate Seen As Tough on Musharraf
Via AP -
ISLAMABAD, Pakistan (AP) — Pakistan's prime minister-in-waiting has the experience and track record to hold together an unwieldy coalition as it moves to neutralize President Pervez Musharraf, lawmakers and analysts said Sunday.
But Yousaf Raza Gilani also has a personal reason to ignore Musharraf's appeals for cooperation: he spent years in jail under the U.S.-backed leader.
Lawmakers are expected to confirm him in a parliamentary vote Monday. He is a shoo-in after opposition parties swept elections last month and Musharraf is then expected to swear him in Tuesday.
"Mr. Gilani is a man who suffered from Musharraf's martial law," said Ahsan Iqbal, a lawmaker for one of four parties which have agreed to form a new coalition government and are expected to elect him with a thumping majority. "He understands well that getting rid of dictatorship is important."
Gilani, a loyalist of slain former premier Benazir Bhutto, will lead an administration facing mounting economic problems, including double-digit inflation, power shortages and sagging foreign investment.
Bhutto's Pakistan People's Party named Gilani as its candidate on Saturday after winning the largest bloc in parliament in Feb. 18 elections.
Western governments fearful of a resurgence of al-Qaida in Pakistan's ungoverned region bordering Afghanistan urgently want to know what changes the government will make to Musharraf's unpopular, military-led policies against Islamic extremism.
In a speech marking Pakistan's national day on Sunday, Musharraf hailed the start of a "new era of real democracy" in Pakistan and vowed to support the new cabinet.
"I hope the new government can maintain peace and the fast pace of socio-economic development in Pakistan," Musharraf said at a parade of jets and missiles from Pakistan's nuclear-capable arsenal. "And I hope it will also continue our struggle against the curse of terrorism and extremism with the same force."
However, the declared priority for the parties which won the parliamentary vote is bolstering democracy by further capping Musharraf's already diminished powers.
"All political forces have to work together to take the country out of this crisis," Gilani said Sunday, vowing to restore the independence of Pakistan's judges and media.
Asked whether he would work with Musharraf or push him from office, he said only: "I will follow the constitution."
Information Storage in Three Dimensions
Via Physorg.com -
For the first time, researchers have successfully turned a glass material into three-dimensional information storage using a light-based technique. This achievement may be a big step forward for the real-life implementation of such materials, which have the potential to store terabits of data (1,000 gigabits, or about 125 gigabytes) in just a single cubic centimeter.
The research was performed by scientists from the University of Bordeaux 1, one of the four universities in Bordeaux, France. The work is described in a paper published in the February 13, 2008, online edition of Optics Letters.
“The necessity for increasing data storage capacity of memory devices, along with the growth of high-density technologies, requires the use of three-dimensional optically based systems,” said physicist Lionel Canioni, one of the paper's authors, to PhysOrg.com.
There are a few methods being explored for optical-based three-dimensional information storage. One method is based on the phenomenon of “photochromism,” which, simply put, is when a material can reversibly change color -- i.e. undergo a chemical change -- when exposed to electromagnetic radiation (light). An everyday example are “transition”-type sunglass lenses.
Photochromism is an example of “single-photon” excitation, meaning that each photon in the light source (such as a laser beam) excites a single electron in the material. When those electrons quickly become de-excited, they each emit a single photon with almost the same energy as the absorbed photon.
Another promising method, explored by Canioni and his colleagues, involves multi-photon excitation—the excited electrons each absorb multiple photons—and is therefore a bit more sophisticated. Because each electron that is excited absorbs more than one photon, the laser interacts with a smaller volume of material. This allows the storage material to be activated with a higher spatial resolution in three dimensions, which allows for a larger information storage density.
---------------------------
Awesome, the future is going to be sweet...
For the first time, researchers have successfully turned a glass material into three-dimensional information storage using a light-based technique. This achievement may be a big step forward for the real-life implementation of such materials, which have the potential to store terabits of data (1,000 gigabits, or about 125 gigabytes) in just a single cubic centimeter.
The research was performed by scientists from the University of Bordeaux 1, one of the four universities in Bordeaux, France. The work is described in a paper published in the February 13, 2008, online edition of Optics Letters.
“The necessity for increasing data storage capacity of memory devices, along with the growth of high-density technologies, requires the use of three-dimensional optically based systems,” said physicist Lionel Canioni, one of the paper's authors, to PhysOrg.com.
There are a few methods being explored for optical-based three-dimensional information storage. One method is based on the phenomenon of “photochromism,” which, simply put, is when a material can reversibly change color -- i.e. undergo a chemical change -- when exposed to electromagnetic radiation (light). An everyday example are “transition”-type sunglass lenses.
Photochromism is an example of “single-photon” excitation, meaning that each photon in the light source (such as a laser beam) excites a single electron in the material. When those electrons quickly become de-excited, they each emit a single photon with almost the same energy as the absorbed photon.
Another promising method, explored by Canioni and his colleagues, involves multi-photon excitation—the excited electrons each absorb multiple photons—and is therefore a bit more sophisticated. Because each electron that is excited absorbs more than one photon, the laser interacts with a smaller volume of material. This allows the storage material to be activated with a higher spatial resolution in three dimensions, which allows for a larger information storage density.
---------------------------
Awesome, the future is going to be sweet...
Ultra-Fast Quantum-Dot Information Storage
Via Physorg.com -
The information-storage market is dominated by two main types: Flash memory, used in memory sticks and cell phones, and dynamic random access memory (DRAM), which is the main memory in a personal computer. Both types have their advantages and disadvantages, but a new type of memory, based on tiny atom clusters, called quantum dots, may soon displace both of them.
In research published in the March 4, 2008, online edition of Applied Physics Letters, scientists from the Technical University of Berlin, in Germany, and Istanbul University, in Turkey, describe how they created a type of quantum-dot-based memory device that can save information at speeds of only a few nanoseconds (billionths of a second).
The paper's lead author, Technical University of Berlin scientist Martin Geller, explained to PhysOrg.com, “Flash memory, which is today's market-driver in the semiconductor industry, and which everybody knows from memory sticks, digital cameras, and mp3-players, has a slow write time. The semiconductor industry is seeking faster Flash memories, but hasn't found an ultimate solution yet. Our quantum-dot-based memory may provide long storage time without power consumption of Flash memory, as wells as a fast write time and better scalability to real-life devices."
To be fair, the other established predecessor of quantum-dot memory, DRAM, does have some excellent qualities. It offers very fast information-access times—under 20 nanoseconds—and the information can be repeatedly written and rewritten on a DRAM; it has excellent so-called endurance. But a DRAM device has a big disadvantage: It is volatile, meaning the information has to be refreshed every ten milliseconds to be maintained, also resulting in a high power consumption.
"The very first prototype of our new quantum-dot-based memory scheme is already almost as fast as DRAM,” said Andreas Marent, a physicist at the Technical University of Berlin who took part in the research. “And in contrast to DRAM or Flash, the physical characteristics of quantum dots limit the write time to the picosecond, or trillionth of a second, range. That means a better device prototype should be more than 100 times faster than today's DRAM.”
The information-storage market is dominated by two main types: Flash memory, used in memory sticks and cell phones, and dynamic random access memory (DRAM), which is the main memory in a personal computer. Both types have their advantages and disadvantages, but a new type of memory, based on tiny atom clusters, called quantum dots, may soon displace both of them.
In research published in the March 4, 2008, online edition of Applied Physics Letters, scientists from the Technical University of Berlin, in Germany, and Istanbul University, in Turkey, describe how they created a type of quantum-dot-based memory device that can save information at speeds of only a few nanoseconds (billionths of a second).
The paper's lead author, Technical University of Berlin scientist Martin Geller, explained to PhysOrg.com, “Flash memory, which is today's market-driver in the semiconductor industry, and which everybody knows from memory sticks, digital cameras, and mp3-players, has a slow write time. The semiconductor industry is seeking faster Flash memories, but hasn't found an ultimate solution yet. Our quantum-dot-based memory may provide long storage time without power consumption of Flash memory, as wells as a fast write time and better scalability to real-life devices."
To be fair, the other established predecessor of quantum-dot memory, DRAM, does have some excellent qualities. It offers very fast information-access times—under 20 nanoseconds—and the information can be repeatedly written and rewritten on a DRAM; it has excellent so-called endurance. But a DRAM device has a big disadvantage: It is volatile, meaning the information has to be refreshed every ten milliseconds to be maintained, also resulting in a high power consumption.
"The very first prototype of our new quantum-dot-based memory scheme is already almost as fast as DRAM,” said Andreas Marent, a physicist at the Technical University of Berlin who took part in the research. “And in contrast to DRAM or Flash, the physical characteristics of quantum dots limit the write time to the picosecond, or trillionth of a second, range. That means a better device prototype should be more than 100 times faster than today's DRAM.”
Saturday, March 22, 2008
More Malvertising on Myspace
Yet again, another example of malvertising on Myspace. Does this ad look familiar??
The VML ActiveX Control is loading from the IP address highlighted in red.
The WHOIS for the IP points to Russia. Thanks to Fergie for point out the error in my intial research.
This IP address have been connected to other malware issues in the past.
I didn't dig too much into this malware ad, since I wasn't in a secure VM.
Malvertising is a very serious issue and it will only get worse before it gets better.
The VML ActiveX Control is loading from the IP address highlighted in red.
The WHOIS for the IP points to Russia. Thanks to Fergie for point out the error in my intial research.
This IP address have been connected to other malware issues in the past.
I didn't dig too much into this malware ad, since I wasn't in a secure VM.
Malvertising is a very serious issue and it will only get worse before it gets better.
Subscribe to:
Posts (Atom)