|
features post news
(SMS/Articles)
featured download
Recent News
MS forensics tool leaks onto the web
@ Nov 13 2009, 12:12 (UTC+0) | From: Amos-Trask :
Microsoft's point-and-click "computer forensics for cops" tool has leaked onto the web.
COFEE (Computer Online Forensic Evidence Extractor) is designed to allow law enforcement officers to collect digital evidence from a suspect's PC without requiring any particular expertise. Using the technology - which recovers a list of processes running on an active computer at the scene of an investigation - involves inserting a specially adapted USB stick into a computer.
Continued... |
|
Leaking crypto keys from mobile devices
@ Oct 22 2009, 12:01 (UTC+0) | From: data :
Security researchers have discovered a way to steal cryptographic keys that
are used to encrypt communications and authenticate users on mobile devices
by measuring the amount of electricity consumed or the radio frequency
emissions.
Continued...
|
|
Spamwashers hijacked, a wake-up call for lazy sysadmins everywhere
@ Oct 05 2009, 16:31 (UTC+0) | From: PSY0NIC :
A Third Time, Uncharmed
Spamwashers hijacked, a wake-up call for lazy sysadmins everywhere. The slow bruteforcers are back for another round.
A new round of slow, distributed bruteforce attacks is in progress. Just like the other times we know about (see references later), the initial target is root. This time around I see only one of my ssh-contactable machines targeted, and the dribble started on September 30th.
Continued... |
|
Microsoft to release free anti-virus software today
@ Sep 29 2009, 20:48 (UTC+0) | From: Kirt :
Security Essentials has been available in beta since June, but will go live for everyone on 29 September. The software will update its anti-virus signature daily to deal with new threats.
Continued... |
|
TI vs. Calculator Hackers
@ Sep 25 2009, 22:35 (UTC+0) | From: data :
"So a bunch of TI calculator programming enthusiasts got together to factor the keys Texas Instruments uses to sign the operating system binaries for the ti83+ (a z80 architecture) and the ti89/v200 (a 68k architecture) series of calculators. Now Texas Instruments is sending out DMCA notices to take them down."
Continued...
Discuss Here
|
|
Verizon, AT&T: Net neutrality not OK for wireless
@ Sep 22 2009, 06:15 (UTC+0) | From: spider-man :
The wireless industry is gearing up to fight new Net neutrality rules that the Federal Communications Commission is formulating to keep the Internet open.
On Monday, FCC Chairman Julius Genachowski gave a speech at the Brookings Institute in Washington, D.C., outlining plans to turn the agency's principles for open Internet access into official regulation.
In addition to making sure that network operators cannot prevent users from accessing lawful Internet content, applications, and services of their choice, or attaching unharmful devices to the network, Genachowski wants to add two more rules.
Continued...
|
|
Linux webserver botnet pushes malware
@ Sep 14 2009, 11:02 (UTC+0) | From: Cygnum :
A security researcher has discovered a cluster of infected Linux servers that have been corralled into a special ops botnet of sorts and used to distribute malware to unwitting people browsing the web.
Each of the infected machines examined so far is a dedicated or virtual dedicated server running a legitimate website, Denis Sinegubko, an independent researcher based in Magnitogorsk, Russia, told The Register. But in addition to running an Apache webserver to dish up benign content, they've also been hacked to run a second webserver known as nginx, which serves malware.
Continuted..
|
|
Bug exposes eight years of Linux kernel
@ Aug 14 2009, 15:56 (UTC+0) | From: Kirt :
Linux developers have issued a critical update for the open-source OS after researchers uncovered a vulnerability in its kernel that puts most versions built in the past eight years at risk of complete takeover.
Continued... |
|
Linux Credit Card
@ Jul 30 2009, 12:08 (UTC+0) | From: data :
The Linux Foundation is pleased to offer a Linux-branded affinity credit card for those who want to support the Linux Foundation's activities while expressing their commitment to Linux. The Linux-branded credit card is an easy way for anyone to contribute to the growth of Linux and identify themselves as supporters of the community by carrying Tux in their pocket.
Continued...
|
|
NIST announces SHA-3 round 2 candidates
@ Jul 26 2009, 07:57 (UTC+0) | From: data :
A report summarizing NIST's selection of these candidates will be
forthcoming. A year is allocated for the public review of these
algorithms, and the Second SHA-3 Candidate Conference is being planned
for August 23-24, 2010, after Crypto 2010.
Shortlisted for round 2:
BLAKE,Blue Midnight Wish,
CubeHash,ECHO,Fugue,
Grostl,Hamsi,JH,Keccak,Luffa,
Shabal,SHAvite-3,SIMD,Skein
Continued... |
|
iPhone security cracked, smacked and broken
@ Jul 24 2009, 20:02 (UTC+0) | From: Kirt :
A researcher has delved into the encryption used to protect content on the iPhone 3GS, only to claim it is "entirely useless" and that he had "[never] seen encryption implemented so poorly before".
Continued... |
|
IEEE 802.11n Heads for a September Finish
@ Jul 23 2009, 18:48 (UTC+0) | From: looserpedro :
The IEEE 802.11n standard is likely to be approved in September, making the high-speed wireless LAN technology official after about seven years of wrangling and refinement.
Continued... |
|
Chinese firms behind 'Sexy Space' Trojan
@ Jul 22 2009, 20:35 (UTC+0) | From: Kirt :
F-Secure has identified three China-based companies as the creators of the "Sexy Space" Trojan, which was identified last week to have passed through Symbian Foundation's digital-signing process.
Continued...
|
|
Linux flaw bypasses security
@ Jul 22 2009, 16:01 (UTC+0) | From: Kirt :
A security researcher has released zero-day code for a flaw in the Linux kernel, saying that it bypasses security protections in the operating system.
Continued... |
|
New Technology to Make Digital Data Self-Destruct
@ Jul 22 2009, 09:39 (UTC+0) | From: Cygnum :
A group of computer scientists at the University of Washington has developed a way to make electronic messages “self destruct” after a certain period of time... the researchers said they had struck upon a unique approach that relies on “shattering” an encryption key that is held by neither party in an e-mail exchange but is widely scattered across a peer-to-peer file sharing system.
Continued...
|
|
Five Technologies Iran is Using to Censor the Web From IP blocking to DPI, a look at how the Iranian government is censoring dissent
@ Jul 21 2009, 09:14 (UTC+0) | From: looserpedro :
One month after a disputed presidential election sparked widespread unrest in Iran, the country's government has initiated a cyber-crackdown that is challenging hackers across the globe to find new ways to help keep Iranian dissidents connected to the Web.
Continued...
|
|
Could You Be Hacked Like Twitter?
@ Jul 21 2009, 09:04 (UTC+0) | From: looserpedro :
The French hacker who broke into Twitter's Google Apps and stole more than 300 private company documents has revealed in detail how he did it. Using a method known as "cracking," the man who goes by the name Hacker Croll was able to break down Twitter security by trolling the Web for publicly available information, according to TechCrunch. Eventually, Croll found one weakness many of us are guilty of -- using one password for everything -- and Twitter's security was compromised. Read on to see how Hacker Croll did it, and consider whether access to your digital life could be breached by his methods.
Continued...
Editor note: What is interesting is it works!
|
|
How to use electrical outlets and cheap lasers to steal data
@ Jul 16 2009, 15:34 (UTC+0) | From: human :
If attackers intent on data theft can tap into an electrical socket near a computer or if they can draw a bead on the machine with a laser, they can steal whatever is being typed into it.
How to execute these attacks will be demonstrated at the Black Hat USA 2009 security conference in Las Vegas later this month by Andrea Barisani and Daniele Bianco, a pair of researchers for network security consultancy Inverse Path.
Continued... |
|
Ever Better Cryptanalytic Results Against SHA-1
@ Jul 15 2009, 16:49 (UTC+0) | From: data :
The SHA family (which, I suppose, should really be called the MD4 family) of cryptographic hash functions has been under attack for a long time. In 2005, we saw the first cryptanalysis of SHA-1 that was faster than brute force: collisions in 2^69 hash operations, later improved to 2^63 operations. A great result, but not devastating. But remember the great truism of cryptanalysis: attacks always get better, they never get worse. Last week, devastating got a whole lot closer. A new attack can, at least in theory, find collisions in 2^52 hash operations -- well within the realm of computational possibility. Assuming the cryptanalysis is correct, we should expect to see an actual SHA-1 collision within the year.
Note that this is a collision attack, not a pre-image attack. Most uses of hash functions don't care about collision attacks. But if yours does, switch to SHA-2 immediately.
This is why NIST is administering a SHA-3 competition for a new hash standard. And whatever algorithm is chosen, it will look nothing like anything in the SHA family (which is why I think it should be called the Advanced Hash Standard, or AHS).
A copy of this essay, with all embedded links, is
Here...
Source: Bruce Schneier Blog
|
|
Acceptable DRM? PRISM thinks so
@ Jul 10 2009, 21:01 (UTC+0) | From: Iolaus :
Apparently so, and in the world of computer games no less. Yes I know this confounds previous media coverage, or user experience, with games DRM (e.g. think Spore), but there is strong indication that one company may have come up with something close to acceptable DRM for gamers.
Continued...
|
|
|
SHA-3 Hardware speed comparisons for second round candidates
@ Articles -> Link
Nov 17 2009, 13:32 (UTC+0) | High-Speed Hardware Implementations of BLAKE, Blue Midnight Wish, CubeHash, ECHO, Fugue, Grostl, Hamsi, JH, Keccak, Luffa, Shabal, SHAvite-3, SIMD, and Skein
Stefan Tillich and Martin Feldhofer and Mario Kirschbaum and Thomas Plos and Jorn-Marc Schmidt and Alexander Szekely
Abstract: In this paper we describe our high-speed hardware implementations of the 14 candidates of the second evalution round of the {SHA-3} hash function competition. We synthesized all implementations using a uniform tool chain, standard-cell library, target technology, and optimization heuristic. This work provides the fairest comparison of all second-round candidates to date.
PDF
Discuss Here |
|
"Evil Maid" Attacks on Encrypted Hard Drives
@ Articles -> Link
Nov 16 2009, 18:01 (UTC+0) | Earlier this month, Joanna Rutkowska implemented the "evil maid" attack against TrueCrypt. The same kind of attack should work against any whole-disk encryption, including PGP Disk and BitLocker. Basically, the attack works like this:
Step 1: Attacker gains access to your shut-down computer and boots it from a separate volume. The attacker writes a hacked bootloader onto your system, then shuts it down.
Continued...
A real world evil maid attack Here...
Discuss Here... |
|
Countering Kernel Rootkits with Lightweight Hook Protection
@ Articles -> Link
Nov 11 2009, 20:53 (UTC+0) | The spread of malicious software, also known as malware or computer viruses, is a growing problem that can lead to crashed computer systems, stolen personal information, and billions of dollars in lost productivity every year. One of the most insidious types of malware is a "rootkit," which can effectively hide the presence of other spyware or viruses from the user -- allowing third parties to steal information from your computer without your knowledge. But now researchers from North Carolina State University have devised a new way to block rootkits and prevent them from taking over your computer systems.
News on ScienceDaily
"Countering Kernel Rootkits with Lightweight Hook Protection," by Zhi Wang, Xuxian Jiang, Weidong Cui, and and Peng Ning.
Abstract: Kernel rootkits have posed serious security threats due to their stealthy manner. To hide their presence and activities, many rootkits hijack control flows by modifying control data or hooks in the kernel space. A critical step towards eliminating rootkits is to protect such hooks from being hijacked. However, it remains a challenge because there exist a large number of widely-scattered kernel hooks and many of them could be dynamically allocated from kernel heap and co-located together with other kernel data. In addition, there is a lack of flexible commodity hardware support, leading to the so called protection granularity gap kernel hook protection requires byte-level granularity but commodity hardware only provides pagelevel protection.
continued... |
|
Schneier-Ranum Face-Off: Is antivirus dead?
@ Articles -> Link
Nov 09 2009, 18:40 (UTC+0) | Point: Marcus Ranum
What amazes me is that it's 2009 and the security world's response to viruses and malware is still oriented toward "detect the bad" rather than "permit the good." And, consequently, we still have viruses and malware. To me, it just seems so gosh-darned obvious that our problem is that we have lost control over our runtime environment, and regaining that control is "simply" a matter of deciding what programs we want to allow to run.
Continued...
Discuss Here |
|
EDRi-gram - Number 7.21, 4 November 2009
@ Articles -> Link
Nov 08 2009, 21:14 (UTC+0) | biweekly newsletter about digital civil rights in Europe
01.We're on Twitter !
02.Compromise on Amendment 138. Telecom Package finalised
03.Free as in Free Culture
04.Declaration on Global Privacy Standards
05.Petition against data retention in Belgium
06.ISPs Meeting sparks debate over Dutch Data Retention obligations
07.Internet blocking gets a red card !
08.Third PrivacyOS: More Privacy, Increased awareness
09.France: Second version of the three strikes law is in place
10.Three strikes plans in UK
11.EU-US common set of principles on data protection and sharing
12.ENDitorial: ACTA revealed, European ISPs might have a big problem
13.Recommended Action
14.Recommended Reading
15.Agenda
Continued...
Discuss Here |
|
List puzzle
@ Out of the box
Oct 29 2009, 15:17 (UTC+0) | data writes: Your friendly 3 letter organization is in the neighborhood hiring mathematicians and computer scientists. One of their interview questions reads as follows:.
Let H be the pointer given to the head of a linked list. Determine whether the given linked list is circular or not. Note: if the list is a circular linked list, the last node of the linked list need not necessarily point to the first node in the linked list; it can point to any other node.
1) Give an algorithm that do this in O(n^2) time
2) Give an algorithm that do this in O(n) time.
Here n is the number of nodes
Discuss Here
For previous puzzle solution
Click Here |
|
EDRi-gram newsletter - Number 7.20, 21 October 2009
@ Articles -> Link
Oct 22 2009, 11:52 (UTC+0) | biweekly newsletter about digital civil rights in Europe
1. EDRI Open Letter to the EP on Amendment 138
2. Romania: Data retention law declared unconstitutional
3. France pushes the introduction of EDVIGE project through the back door
4. Web blocking gets a reality check
5. Buma/Stemra imposes levy for embedding audio and video
6. Copyright in the digital environment
7. The European Commission calls for online privacy protection measures
8. Microsoft tries to comply with EU requirements
9. Finland: Introducing Internet broadband as a universal service
10. Recommended Reading
11. Agenda
12. About
Continued...
Discuss Here
|
|
Don't drop the soap #3 - the fun continues
@ Out of the box
Oct 10 2009, 12:42 (UTC+0) | Cygnum writes: You've been caught again. This time, for downloading many gigabytes of copyright g0at porn. You've been sued and sentenced to go to the same prison as in don't drop the soap 2 . Upon your arrival to the prison, you notice a change in the way inmates are handled... The prison rules have changed a bit and now the authorities arrange the inmates into lines 20 prisoners long and put on their heads not 2 colors but 20 different colors of hats. The question remains the same as in "don't drop the soap #2" - how can such a line of prisoners save at least 19 of its 20 members?
Note that the rules of "don't drop the soap #2" apply here too except for the length of the line (20 rather than unknown) and the number of hat colors (20 rather than 2).
Good Luck!
Discuss Here
|
|
EDRi-gram, Number 7.19, 7 October 2009
@ Articles -> Link
Oct 10 2009, 12:41 (UTC+0) |
biweekly newsletter about digital civil rights in Europe
============================================================
Contents
============================================================
1. Controversial draft Framework Decision on Child Sexual Exploitation
2. Reding: EU policy for information society for the next years
3. Turkey blocks thousands of foreign websites
4. Deja-vu: France's three-strikes law referred to Constitutional Council
5. The Pirate Bay may be banned in Italy
6. France wants to filter online gambling sites
7. Paris Court of Appeals on a GPL - related case
8. US gives up its unilateral supervision powers over ICANN
9. ENDitorial: Amendment 138-EP asked to choose between democracy and defeat
10. Recommended Reading
11. Agenda
12. About
Continued...
|
|
Dark room
@ Out of the box
Oct 02 2009, 16:32 (UTC+0) | Cygnum writes: This one should be pretty simple:
You've been blinded an put in a dark room where YOU CANNOT SEE ANYTHING. In front of you is a table with 100 coins. The coins have two sides (amazing, isn't it?) - one side is black, the other white. You know that 90 of the coins are with the black side up, 10 are with the white side up. All coins are arranged randomly on the table. All coins feel, smell and sound exactly the same on both sides (so don't try any tricks there).
Your job is to divide the coins on the table into two groups so that each group will have the same number of coins with the white side facing up.
Good Luck!
Discuss Here
|
|
GFI LANguard Version 9 Review
@ Articles -> Security
Sep 24 2009, 19:03 (UTC+0) | marek writes: INTRODUCTION
GFI LANguard v9 is the latest version of GFI’s network security scanner. GFI LANguard offers a comprehensive solution for network administrators to manage their computers, detect security vulnerabilities on their network and resolve them quickly and easily. GFI LANguard focuses primarily on Microsoft Windows networks, although some of the features can be used for non-Windows computers such as those running Linux.
continued... |
|
Crypto backdoor in Qnap storage devices
@ Articles -> Link
Sep 24 2009, 19:01 (UTC+0) | Overview:
The premium and new line of QNAP network storage solutions allow
for full hard disk encryption. When rebooting, the user has to
unlock the hard disk by supplying the encryption passphrase via
the web GUI.
However, when the hard disk is encrypted, a secondary key is
created, added to the keyring, and stored in the flash with minor
obfuscation.
Continued...
Discuss Here
|
|
Status Report on the First Round of the SHA-3 Cryptographic Hash Algorithm Competition
@ Articles -> Link
Sep 18 2009, 19:52 (UTC+0) | Editor Note: A good white paper that briefly describes the evaluation criteria for selecting round-2 candidates and a short description of the candidates that made it to round 2. Does anyone feel that the document is a bit too vague?
PDF
Discuss Here
|
|
Hacking Swine Flu
@ Articles -> Link
Sep 08 2009, 16:15 (UTC+0) | Editor Note: A little bit of molecular biology for computer scientists.
So how many bits are in this instance of H1N1? The raw number of bits, by my count, is 26,022; the actual number of coding bits approximately 25,054 -- I say approximately because the virus does the equivalent of self-modifying code to create two proteins out of a single gene in some places (pretty interesting stuff actually), so it’s hard to say what counts as code and what counts as incidental non-executing NOP sleds that are required for self-modifying code.
So it takes about 25 kilobits -- 3.2 kbytes -- of data to code for a virus that has a non-trivial chance of killing a human. This is more efficient than a computer virus, such as MyDoom, which rings in at around 22 kbytes.
Continued...
Source: Bruce Schneier Blog
More Here
Discuss Here
|
|
Microsoft working to eliminate Internet anonymity
@ Articles -> Link
Sep 03 2009, 16:18 (UTC+0) | Microsoft researchers have unveiled an anti-hacking concept that can help track hackers or malicious content to origin servers.
The Host Tracker program's goal is to "de-anonymize the Internet" through the ability to host servers with 99 percent accuracy.
Host Tracker is designed to unmask would-be hackers who take advantage of anonymizing techniques by cross-referencing Internet protocol traffic data to identify the true origin. Microsoft's representatives said the Host Tracker system relies on application-level events -- in this case, Internet Explorer browser sessions -- to automatically infer host-IP bindings.News
PDF
Discuss Here
|
|
You Deleted Your Cookies? Think Again
@ Articles -> Link
Aug 23 2009, 21:43 (UTC+0) | More than half of the internet’s top websites use a little known capability of Adobe’s Flash plug-in to track users and store information about them, but only four of them mention the so-called Flash Cookies in their privacy policies, UC Berkeley researchers reported Monday.
Unlike traditional browser cookies, Flash cookies are relatively unknown to web users, and they are not controlled through the cookie privacy controls in a browser. That means even if a user thinks they have cleared their computer of tracking objects, they most likely have not.
Continued...
Discuss Here
|
|
The weight problem
@ Out of the box
Aug 18 2009, 18:31 (UTC+0) | Cygnum writes: What seven weights do you need to be able to measure every weight between 1 and 1000 kg (with a resolution of 1 kg) on a (heavy duty) balance scale?
NO programming!
Discuss Here.
|
|
Don't drop the soap #2
@ Out of the box
Aug 06 2009, 13:27 (UTC+0) | Cygnum writes: Since the circular prison 4000 has been found to provide inadequate security and the circular prison 5000 project (that featured trained killer rabbits) was canceled due to budget cuts (the economy hit there too), officials proposed a new money saving idea:
New inmates will be brought to the prison yard and ordered to stand in a single file line. A guard will then walk along the line and put either a white or a black hat on each prisoner. The prisoners themselves do not know which hat they were given, they can only see the hats of the prisoners in front of them.
A second guard then passes along the line from the end of the line (where the prisoner that sees EVERYONE else is located) to the beginning of the line (where the prisoner that sees NO ONE is located). He asks each prisoner in turn if he knows what color hat he has on. The prisoner can only say only "White" or "Black" (nothing else!) and if he's right, he's immediately released from prison (thus saving valuable tax dollars); if he's wrong, he's immediately shot dead (again, thus saving valuable tax dollars).
You were (once again) unjustly convicted of a crime (she really did tell you she was 18!!) and you arrive with a group of prisoners to the above mentioned prison yard. You have a few minutes to decide on a strategy with the other prisoners before the gruesome process begins.
What strategy can you use to save all prisoners except (maybe) one?
Discuss Here
|
|
Another New AES Attack
@ Articles -> Link
Aug 02 2009, 09:44 (UTC+0) |
A new and very impressive attack against AES has just been announced.
[...]
This new attack, by Alex Biryukov, Orr Dunkelman, Nathan Keller, Dmitry Khovratovich, and Adi Shamir, is much more devastating. It is a completely practical attack against ten-round AES-256.
Abstract.
AES is the best known and most widely used block cipher. Its three versions (AES-128, AES-192, and AES-256) differ in their key sizes (128 bits, 192 bits and 256 bits) and in their number of rounds (10, 12, and 14, respectively). In the case of AES-128, there is no known attack which is faster than the 2^128 complexity of exhaustive search. However, AES-192 and AES-256 were recently shown to be breakable by attacks which require 2^176 and 2^119 time, respectively. While these complexities are much faster than exhaustive search, they are completely non-practical, and do not seem to pose any real threat to the security of AES-based systems.
In this paper we describe several attacks which can break with practical complexity variants of AES-256 whose number of rounds are comparable to that of AES-128. One of our attacks uses only two related keys and 2^39 time to recover the complete 256-bit key of a 9-round version of AES-256 (the best previous attack on this variant required 4 related keys and 2^120 time). Another attack can break a 10 round version of AES-256 in 2^45 time, but it uses a stronger type of related subkey attack (the best previous attack on this variant required 64 related keys and 2^172 time).
Source: Bruce Schneier Blog
Continued...
Discuss Here.
|
|
EDRi-gram newsletter - Number 7.15, 29 July 2009
@ Articles -> Link
Jul 30 2009, 09:48 (UTC+0) |
biweekly newsletter about digital civil rights in Europe
========
Contents
========
1. Hadopi 2's final vote is postponed till 15 September
2. EU wants to share more bank details with the US authorities
3. EC hearing on Google book deal
4. UK ISP gave up direct disconnection of file-sharers for a three strikes
5. Finnish CSS case application lodged in the European Court of Human Rights
6. EDPS: New privacy issues in relation to intelligent transport systems
7. France: CNIL's opinion on LOPPSI draft law
8. Russian Copyright law will apply to news reports
9. Recommended Action
10. Recommended Reading
11. Agenda
12. About
Continued...
|
|
the older posts:
Top of page
|
featured article List puzzle
Your friendly 3 letter organization is in the neighborhood hiring mathematicians and computer scientists. One of their interview questions reads as follows:.
Let H be the pointer given to the head
read here
poll
Which profesional degree do you think will meet your needs best?
|
linking & backends Information about how to link to NewOrder.
New Order news rss feed,
a sms rss feed or a complete list. |
