Skip to main content

Welcome

News, Announcements, Tech Discussions

44770 Topics
Miquell
Community Leader
MiquellCommunity Leader
posted in Security Industry News
Heartbleed saga continues: highlights of vulnerability's first 30 Days

[b]Heartbleed Saga Continues: Highlights of Vulnerability's First 30 Days[/b] by Sean Michael Kerner   On April 7, the Heartbleed vulnerability, one of the most impactful security incidents of the last decade, was first publicly disclosed. Technically, the Heartbleed flaw is identified as CVE-2014-0160 and called "TLS heartbeat read overrun". It is found within the open-source OpenSSL cryptographic library, which provides Secure Sockets Layer (SSL) encryption capabilities for data in transit. OpenSSL is widely deployed on servers and embedded devices, which is one of the many reasons why Heartbleed has been able to wreak so much havoc. Heartbleed could potentially enable an attacker to read the memory from a vulnerable server, which could lead to data theft. Only Google and CloudFlare were made aware of the flaw before it was first publicly disclosed, while other vendors were left scrambling to rapidly issue patches to users. While patches were made available on most platforms wit

4260
Miquell
Community Leader
10 years ago
Miquell
Community Leader
MiquellCommunity Leader
posted in Security Industry News
Ground(ctrl) hacked

[b]Ground(ctrl) Hacked[/b] by Jeff Goldman   Users' e-mail addresses, passwords, and the last four digits and expiration dates of their credit cards may have been accessed. Sacramento-based ground(ctrl), which builds social networking sites and other services for musicians, recently began notifying an undisclosed number of users that their personal information may have been exposed when the company's network was hacked. "Upon learning of the access, we worked to block any further unauthorized access and engaged a leading forensic investigation firm to determine what occurred and assist us in implementing enhanced security measures", company CEO Eddie Meehan wrote in the notification e-mail. The investigation found that the unidentified hacker or hackers may have been able to view users' e-mail addresses, passwords, and the last four digits and expiration dates of their credit cards. "Although we do not store passwords in plain text, we believe the unauthorized person has the

570
Miquell
Community Leader
10 years ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Microsoft calls out malicious downloaders

[b]Anti-malware vendors warned about downloaders used to infect PCs[/b] Microsoft is putting makers of downloader software on notice when it sees that their products are being used to infect PCs, and it is telling anti-virus vendors that perhaps these downloader programs ought to be tagged as malware. In its latest Security Intelligence Report the company notes that the use of formerly benign downloaders has increasingly become a means to infect computers with malware, particularly click-fraud programs and ransomware in which attackers extort cash from victims in return for restoring their machines to a functional state.   [url=http://www.networkworld.com/news/2014/050714-microsoft-calls-out-281373.html?hpg1=bn]Full Article[/url]

6981
Miquell
Community Leader
10 years ago
nic
nicRetired Webrooter
posted in Security Industry News
Grayson interviewed at RSA about the Target security breach

[user=274][/user] talks with Alicia Webb from SecureNinjaTV at RSA:   [video]https://www.youtube.com/watch?v=cU7OVhnXxLI[/video]

4221
Ssherjj
Moderator
10 years ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Security industry clashes over perks and pitfalls of antivirus tools

by [url=http://www.v3.co.uk/author/profile/372/dave-neal]Dave Neal   [/url]07 May 2014  The security industry is at loggerheads over the importance of anti-virus tools with major players in the sector coming out in support of, or against, such services. Brian Dye, senior vice president for information security at Symantec, kicked off the debate when he said antivirus is not big business anymore and does not make the firm much money. Dye was speaking to [i]The Wall Street Journal[/i] when he rang time on the antivirus market: The software is "dead", he said, adding: "We don't think of antivirus as a money-maker in any way." [url=http://online.wsj.com/news/article_email/SB10001424052702303417104579542140235850578-lMyQjAxMTA0MDAwNTEwNDUyWj][i]The Wall Street Journal[/i][/url] pointed out that antivirus accounts for around 40 percent of the firm's revenues, suggesting Dye had underestimated it. For a firm that has churned out its popular Norton antivirus product for many yea

10
Jasper_The_Rasper
Moderator
10 years ago
nic
nicRetired Webrooter
posted in Tech Talk
Interesting article on what it takes to avoid being tracked by marketing companies

One woman's struggle to avoid being identified as pregnant while using the Internet and making online purchases:   [url=http://time.com/83200/privacy-internet-big-data-opt-out/]http://time.com/83200/privacy-internet-big-data-opt-out/[/url]

40102
jpasternak
Community Leader
10 years ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
France's Orange Hit by Hackers Data Raid

Hackers have stolen the personal data of 1.3 million customers of French telephone company Orange, in the second major breach of its kind in a matter of months. In the latest incident, which was detected on April 18, the hackers acquired names, email addresses, mobile and fixed line numbers, names of mobile and Internet operators and the dates of birth of current and potential customers. "The data recovered could be used to contact those concerned by email, SMS or by phone, particularly for phishing purposes," the group warned in a statement issued this week. A spokesman for the phone operator told AFP late Tuesday the attack affected 1.3 million people.   [url=http://www.securityweek.com/frances-orange-hit-hackers-data-raid]Full Article[/url]

2060
Jasper_The_Rasper
Moderator
10 years ago
Miquell
Community Leader
MiquellCommunity Leader
posted in Security Industry News
Systems admin for Navy nuclear department faces hacking charge

[b]Systems admin for Navy nuclear department faces hacking charge[/b] by Danielle Walker A former Navy member, who served as systems administrator in a nuclear reactor department, faces a federal charge for his alleged involvement in a hacking conspiracy. On Monday, the Department of Justice announced that the Virginia man, Nicholas Knight, was charged with one count of conspiring to hack the computer systems of over 30 public and private entities, while he was an active duty enlisted Navy member.In addition to Knight, a 20-year-old Illinois man, Daniel Krueger, was also charged with the conspiracy count for his alleged part in the scheme. The DOJ release said that the hacking conspiracy was “part of a plan to steal identities, obstruct justice and damage a protected computer”. According to DOJ, the two men were a part of a hacking group called “Team Digi7al,” whose targets included the U.S. Navy, the National Geospatial-Intelligence Agency, and the Department of Homeland Securit

2600
Miquell
Community Leader
10 years ago
Miquell
Community Leader
MiquellCommunity Leader
posted in Security Industry News
Advanced Persistent Threats not so advanced anymore, researchers find

[b]Advanced Persistent Threats not so advanced anymore, researchers find[/b] by Adam Greenberg   The classic Advanced Persistent Threat (APT) – a moniker traditionally given to months or years-long cyber attacks against specifically targeted organizations – is not so advanced anymore, according to researchers with Imperva. In a Tuesday report, aptly titled “The Non-Advanced Persistent Threat,” Imperva experts explored how compromising sensitive and confidential data in recent APTs is more efficient and streamlined, as opposed to elaborate, sophisticated and lengthy. In the study, Imperva researchers focused on how attackers can rather seamlessly escalate privileges in organizations and steal the data from file servers, Microsoft SharePoint, or database servers, all without using zero-day vulnerabilities and other advanced exploits.   [url=http://www.scmagazine.com/advanced-persistent-threats-not-so-advanced-anymore-researchers-find/article/345802/]Full Article[/url]

2830
Miquell
Community Leader
10 years ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Your Android phone viewed illegal porn. To unlock it, pay a $300 fine

[i][b]To stoke maximum fear, ransomware geolocates users, targets them by country.[/b][/i]   Researchers have uncovered Android-based malware that disables infected handsets until end users pay a hefty cash payment to settle trumped-up criminal charges involving the viewing of illegal pornography. To stoke maximum fear, Android-Trojan.Koler.A uses geolocation functions to tailor the warnings to whatever country a victim happens to reside in. The screenshot to the right invoking the FBI, for instance, is the notice that's displayed on infected phones connecting from a US-based IP address. People in Romania and other countries will see slightly different warnings. The malware prevents users from accessing the home screen of their phones, making it impossible to use most other apps installed on the phone. The normal phone functions in some cases can be restored only when the user pays a "fine" of about $300, using untraceable payment mechanisms such as Paysafecard or uKash.

229611
CameronP
Webroot Employee
10 years ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Microsoft confirms it's dropping Windows 8.1 support

[b]A Microsoft TechNet blog makes clear that Windows 8.1 will not be patched; users must get Windows 8.1 Update if they want security patches[/b] In what is surely the most customer-antagonistic move of the new Windows regime, Steve Thomas at Microsoft posted a TechNet article on Saturday stating categorically that [url=http://blogs.technet.com/b/gladiatormsft/archive/2014/04/12/information-regarding-the-latest-update-for-windows-8-1.aspx]Microsoft will no longer issue security patches for Windows 8.1[/url], starting in May. Call this the "let them eat cake" approach to support for Microsoft's flagship operating system.   [url=http://www.infoworld.com/t/microsoft-windows/microsoft-confirms-its-dropping-windows-81-support-240407]Full Article[/url]

296419
jpasternak
Community Leader
10 years ago
A
adambomb
posted in Community 101
Happy to be here!

[b]I love you Webroot!   You are awesome, and am VERY happy with your products!  Nothing comes close!  My guardian angel in an evasive technical world!   Norton sucks and Webroot trucks!!!!!![/b]

6058
Ssherjj
Moderator
10 years ago
Miquell
Community Leader
MiquellCommunity Leader
posted in Tech Talk
Razer Blade review (2014): a 'no-compromise' premium gaming laptop

[b]Razer Blade review (2014): a 'no-compromise' premium gaming laptop[/b] by Sean Buckley   More often than not, I feel like my feedback -- both as a customer and a writer -- vanishes into a collapsing singularity of customer service. And yet, I've never felt this way about Razer. When the company launched the original Blade gaming laptop, it was panned for being underpowered, so the company replaced it in the same calendar year. When that second-generation machine was written up for being too short-lived, a smaller machine with exceptional battery life hit the market. That machine was judged for having a middling screen, and so Razer answered its critics again, this time with the fourth-generation Razer Blade, a machine that brings more power, more features and a significantly better display. So, does it answer my biggest complaints? Let's find out.   [url=http://www.engadget.com/2014/05/06/Razer-Blade-14-review-2014/]Full Article[/url]

2860
Miquell
Community Leader
10 years ago
Miquell
Community Leader
MiquellCommunity Leader
posted in Tech Talk
EMC launches new supplier exchange, 'Smart' Archive

[b]EMC Launches New Supplier Exchange, 'Smart' Archive[/b] by Chris Preimesberger   New products use existing EMC platforms, including Pivotal CF, an enterprise platform-as-a-service (PaaS) powered by Pivotal Cloud Foundry. EMC's Information Intelligence Group, which used to be Documentum, came out with two new products May 6 at EMC World 2014: its first industry-specific public cloud software as a service, Supplier Exchange, and a "smart" archiver called InfoArchive. Supplier Exchange improves older Documentum-based private-cloud collaboration software to enable similar connections with partners and contractors outside the enterprise in a hybrid-style app. Marketing director Gautam Desai told eWEEK that using Supplier Exchange, contractors can look at RFPs, submit bids and use other documents with security at any time and from any device. The first version of Supplier Exchange is designed specifically for the energy and engineering industries. It enables proje

70
Miquell
Community Leader
10 years ago
Miquell
Community Leader
MiquellCommunity Leader
posted in Security Industry News
MI5: Spies and thieves are targeting & grooming insiders

[b]MI5: Spies and Thieves are Targeting & Grooming Insiders[/b] by infosecurity   MI5 has warned British corporate chiefs that foreign intelligence agencies are targeting IT workers within big organisations in a bid to gain privileged access to sensitive data. The act of grooming internal sources with access to highly sensitive information has been likened to the practices of Cold War spymasters, and MI5 has used the analogy to urge more companies to boost their overall IT defenses.  “This warning confirms something that we’ve been saying for a while now – that the abuse of privileged credentials is the next frontier for cyber-crime against enterprises”, said Paul Ayers, vice president of EMEA at enterprise data security firm Vormetric, in a comment to Infosecurity. “It is clear that businesses are still struggling to defend their most critical assets from those legitimately within the perimeter”. Even junior staff can be targeted and groomed, MI5 warned, as reported

30
Miquell
Community Leader
10 years ago
Miquell
Community Leader
MiquellCommunity Leader
posted in Security Industry News
How to bring agility to legacy collaboration systems: 10 best practices

[b]How to Bring Agility to Legacy Collaboration Systems: 10 Best Practices[/b] by Chris Preimesberger  Document-centric collaboration is now considered a building block of enterprise success, and in the mobile-device world, it's crucial that collaboration extend beyond the internal organization to include external partners and contractors. Yet, with many legacy collaboration and enterprise content management (ECM) solutions lacking in sufficient cloud and mobile features, organizations often rely on third-party file sync and share applications to collaborate outside the firewall. However, complexity begins there, thanks to these different point solutions. Plus, few of these solutions are enterprise-class, which means there are serious implications when it comes to security—especially for regulated industries that share sensitive content. To prevent employees from using unsanctioned tools, IT must offer secure collaboration apps that are built for the enterprise but are still easy

2570
Miquell
Community Leader
10 years ago
Miquell
Community Leader
MiquellCommunity Leader
posted in Security Industry News
EMC unveils its first hybrid cloud solution package

[b]EMC Unveils Its First Hybrid Cloud Solution Package[/b] by Chris Preimesberger   The idea behind the Hybrid Cloud package is to build a bridge between easy-to-use but difficult-to-secure public cloud services and private clouds. Dozens of IT product and service providers now offer various ways for their customers to either build their own private or hybrid clouds or have one of them simply do all the heavy lifting themselves. EMC joined the pack May 6 at the EMC World 2014 conference when it introduced its own EMC Hybrid Cloud package, which the company claims can deliver fast application provisioning/deployment to go with improved levels of IT automation. The idea behind the Hybrid Cloud package is to build a bridge of sorts between easy-to-use but difficult-to-secure public cloud services and the speed/agility/security of purpose-built private clouds. Later, as a company grows or shrinks, the hybrid cloud system can be modified as needed to fill changing production

3210
Miquell
Community Leader
10 years ago
nic
nicRetired Webrooter
posted in Tech Talk
Foldable epaper smartphone

Looks pretty neat: [url=http://www.engadget.com/2014/05/01/paperfold/]http://www.engadget.com/2014/05/01/paperfold/[/url] I'll wait for the color version though :)

4756
C
Popular Voice
10 years ago
Baldrick
Gold VIP
BaldrickGold VIP
posted in Security Industry News
Hacktivists hijack BNP Twitter account, crayon over leader Griffin's too

[H2]I'm the leader of the Gay Orgy Party and we just LOVE immigration, guys. Mwah![/H2]By [url=http://www.theregister.co.uk/Author/2578]John Leyden[/url], 6 May 2014  Hacktivists from Anonymous took over the Twitter feeds of the extreme British National Party and its controversial chairman Nick Griffin over the weekend.   The hack against[b]@NickGriffinMEP[/b]'s profile, which boasts 29,000 followers, was apparently mere mischief rather than a desire to make a point against a politician notorious for his views on ethic minorities, homosexuals, immigrants and many others.  Griffin's bio was modified to read that it was the "official twitter page of British Gay Orgy Party Chairman and Member of the European LGBT Community for the North West region, Nick Griffin".     [url=http://www.theregister.co.uk/2014/05/06/hacktivists_hijack_bnp/]Full Article[/url]     This one will men more to us Brits in the Community...but it is still a good read

8561
nic
10 years ago
Baldrick
Gold VIP
BaldrickGold VIP
posted in Security Industry News
Scariest NSA revelation yet: Spooks are RUBBISH at CIPHERS

[H2]'Encrypted' Tweet takes world+dog a moment or two to solve[/H2]By [url=http://www.theregister.co.uk/Author/2242]Richard Chirgwin[/url], 6 May 2014  The NSA (yes, [i]that[/i] NSA) has triggered a bit of a Tweet-storm, followed by helpless fits of giggles among geeks, by posting a job-ad-Tweet that used a simple Roman-style substitution cipher.   tpfccdlfdtte pcaccplircdt dklpcfrp?qeiq lhpqlipqeodf gpwafopwprti izxndkiqpkii krirrifcapnc dxkdciqcafmd vkfpcadf. [url=https://twitter.com/search?q=%23MissionMonday&src=hash]#MissionMonday[/url] [url=https://twitter.com/search?q=%23NSA&src=hash]#NSA[/url] [url=https://twitter.com/search?q=%23news&src=hash]#news[/url] — NSA (@NSACareers) [url=https://twitter.com/NSACareers/statuses/463321993878994945]May 5, 2014[/url]   The Tweet creeped out some people, but has since been revealed as the first of what the agency says will be an ongoing recruitment campaign seeking “the

6201
nic
10 years ago
Baldrick
Gold VIP
BaldrickGold VIP
posted in Security Industry News
Casino chain Affinity's credit card system popped AGAIN

[H2]The house doesn't always win[/H2]By [url=http://www.theregister.co.uk/Author/2819]Darren Pauli[/url], 6 May 2014  US Casino operator Affinity Gaming has had its credit card processing system hacked for the second time in less than a year.    The Las Vegas-based company said hackers breached a system last month that processed customer credit and debit cards but had no evidence that cards were compromised.  "Affinity Gaming and its IT experts indicate that no credit card data was stolen after late afternoon April 28, 2014," it said in a statement.   Affinity, which ran 11 casinos across four US states, recruited security consultancy Mandiant to investigate the breach.     [url=http://www.theregister.co.uk/2014/05/06/hax0rs_pop_us_casino_chain_again_but_forensics_say_cards_safe/]Full Article[/url]   One for all the closet gamblers amongst us...;)

4830
Baldrick
Gold VIP
10 years ago
Baldrick
Gold VIP
BaldrickGold VIP
posted in Security Industry News
Watch a bank-raiding ZeuS bot command post get owned in 60 seconds

[H2]RC4? Shoddy PHP coding? You VXers should try a little harder[/H2]By [url=http://www.theregister.co.uk/Author/2819]Darren Pauli[/url], 6 May 2014  [b]Vid[/b] Web thieves may get more than they bargained for if tech pros follow the lead of one researcher – who demonstrated how to hack the systems remote-controlling the infamous ZeuS crime bot in 60 seconds.   The dangerous Trojan ZeuS infects Windows PCs to, among other things, silently siphon cash from victims' online bank accounts. Each flavour of the software nasty connects to a control server operated by the various crims distributing it; the bots receive their instructions from this particular server.  Crooks can build their own variant of the Trojan from purchased toolkits or from source code [url=http://www.theregister.co.uk/2011/05/10/zeus_crimeware_kit_leaked/]leaked on underground forums in 2011[/url]. The bot control code running on the command servers is known by malware researchers

20
Baldrick
Gold VIP
10 years ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Dropbox plugs link leak vulnerability

[H2]Links to shared documents exposed.[/H2] Dropbox claims it has patched a vulnerability that could disclose links to users' shared documents through a commonly used website feature, and says it is not aware of the security hole having been exploited. On the company's blog, Dropbox vice president of engineering Aditya Agarwal [url=https://twitter.com/trendinaliaNZ/status/463509542920138753]explained[/url] that shared links to documents can be inadvertently disclosed through referer headers, a feature used by websites to track where visitors have navigated from. This means that those with access to referer header information can see links to shared documents on Dropbox, if these have links to websites and users click on them.   [url=http://www.itnews.com.au/News/384710,dropbox-plugs-link-leak-vulnerability.aspx?utm_source=feed&utm_medium=rss&utm_campaign=iTnews+]Full Article[/url]   See also [url=https://community.webroot.com/t5/Security-Industry-News/Crimew

5250
Jasper_The_Rasper
Moderator
10 years ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Researcher says Apple fibs about crypto for iOS email attachments

[i]Latest iPad and iPad firmware reveals attachments in clear text.[/i]   Apple has been busted for falsely claiming that email attachments sent from iOS are encrypted. German researcher Andreas Kurtz found email attachments for POP, IMAP and ActiveSync accounts were available in clear text on iPhone 4, 5s and iPad 2 devices.  "A few weeks ago, I noticed that email attachments within the iOS 7 MobileMail.app are not protected by Apple's data protection mechanisms," Kurtz said in a [url=http://www.andreas-kurtz.de/2014/04/what-apple-missed-to-fix-in-ios-711.html]blog[/url]. "Considering the long time iOS 7 is available by now (sic) and the sensitivity of email attachments many enterprises share on their devices - fundamentally relying on data protection - I expected a near-term patch."   [url=http://www.theregister.co.uk/2014/05/02/nope_ios_email_attachments_arent_encrypted/]Full Article[/url]

31042
Jasper_The_Rasper
Moderator
10 years ago
Miquell
Community Leader
MiquellCommunity Leader
posted in Security Industry News
OpenSSL gets patch for 4-year-old flaw

[b]OpenSSL Gets Patch for 4-Year-Old Flaw[/b] by Sean Michael Kerner   The open-source OpenSSL cryptographic library is being patched for a pair of security flaws, one of which has been in the code for at least four years. OpenSSL, of course, is the source of the now infamous Heartbleed vulnerability, first disclosed on April 7. While Heartbleed has had a wide-ranging impact that has left hundreds of millions of users vulnerable, the newly patched issues are not quite as dramatic. One of the issues is identified as CVE-2010-5298 and was first publicly reported in 2010. In a blog post, OpenBDD developer Ted Unangst details how he "rediscovered" the 4-year-old flaw and what it could have enabled. In a potential attack scenario detailed by Unangst, two users (Alice and Bob) are posting pictures to a Web server protected by OpenSSL. "There's a chance that a buffer from Alice's connection will be released, and the next free buffer taken instead, which has Bob's data in it", U

4410
Miquell
Community Leader
10 years ago

Badges

Show all badges

Join the Conversation

Terms & Conditions