Forgot your password?
typodupeerror

Slashdot stories can be listened to in audio form via an RSS feed, as read by our own robotic overlord.

Security

Ask Slashdot: Open Hard- & Software Based Security Token?

Posted by timothy
from the you-could-use-postcards-scanned-by-an-arduino dept.
Qbertino (265505) writes I'm just musing about a security setup to allow my coworkers/users access to files from the outside. I want security to be a little safer than pure key or PW based SSH access, and some super-expensive RSA Token Setup is out of question, so I've been wondering if there are any feasible and working FOSS and open hardware based security token generator projects out there. Best with ready-made server-side scripts/daemons. Perhaps something Arduino or Rasberry Pi based? Has anybody tried something like this? What are your experiences? What do you use? How would you attempt an open hardware FOSS solution to this problem?
Security

Put Your Code in the SWAMP: DHS Sponsors Online Open Source Code Testing 43

Posted by timothy
from the they'll-take-a-look-see dept.
cold fjord (826450) writes with an excerpt from ZDNet At OSCon, The Department of Homeland Security (DHS) ... quietly announced that they're now offering a service for checking out your open-source code for security holes and bugs: the Software Assurance Marketplace (SWAMP). ... Patrick Beyer, SWAMP's Project Manager at Morgridge Institute for Research, the project's prime contractor, explained, "With open source's popularity, more and more government branches are using open-source code. Some are grabbing code from here, there, and everywhere." Understandably, "there's more and more concern about the safety and quality of this code. We're the one place you can go to check into the code" ... funded by a $23.4 million grant from the Department of Homeland Security Science & Technology Directorate (DHS S&T), SWAMP is designed by researchers from the Morgridge Institute, the University of Illinois-Champaign/Urbana, Indiana University, and the University of Wisconsin-Madison. Each brings broad experience in software assurance, security, open source software development, national distributed facilities and identity management to the project. ... SWAMP opened its services to the community in February of 2014 offering five open-source static analysis tools that analyze source code for possible security defects without having to execute the program. ... In addition, SWAMP hosts almost 400 open source software packages to enable tool developers to add enhancements in both the precision and scope of their tools. On top of that the SWAMP provides developers with software packages from the National Institute for Standards and Technology's (NIST) Juliet Test Suite. I got a chance to talk with Beyer at OSCON, and he emphasized that anyone's code is eligible — and that there's no cost to participants, while the center is covered by a grant.
Privacy

Ask Slashdot: Preparing an Android Tablet For Resale? 107

Posted by timothy
from the link-free-cloth-and-a-.45 dept.
UrsaMajor987 (3604759) writes I have a Asus Transformer tablet that I dropped on the floor. There is no obvious sign of damage but It will no longer boot. Good excuse to get a newer model. I intend to sell it for parts (it comes with an undamaged keyboard) or maybe just toss it. I want to remove all my personal data. I removed the flash memory card but what about the other storage? I know how to wipe a hard drive, but how do you wipe a tablet? If you were feeling especially paranoid, but wanted to keep the hardware intact for the next user, what would you do?
Bitcoin

US States Edge Toward Cryptocoin Regulation 148

Posted by timothy
from the hey-these-still-smell-like-dollars dept.
SonicSpike points out an article from the Pew Charitable Trusts' Research & Analysis department on the legislation and regulation schemes emerging in at least a few states in reaction to the increasing use of digital currencies like Bitcoin. A working group called the Conference of State Bank Supervisors’ Emerging Payments Task Force has been surveying the current landscape of state rules and approaches to digital currencies, a topic on which state laws are typically silent. In April, the task force presented a model consumer guidance to help states provide consumers with information about digital currencies. A number of states, including California, Massachusetts and Texas, have issued warnings to consumers that virtual currencies are not subject to “traditional regulation or monetary policy,” including insurance, bonding and other security measures, and that values can fluctuate dramatically. ... The article focuses on the high-population, big-economy states of New York, California and Texas, with a touch of Kansas -- but other states are sure to follow. Whether you live in the U.S. or not, are there government regulations that you think would actually make sense for digital currencies?
Security

Attackers Install DDoS Bots On Amazon Cloud 24

Posted by timothy
from the fully-buzzword-compliant dept.
itwbennett (1594911) writes "Attackers are exploiting a vulnerability in distributed search engine software Elasticsearch to install DDoS malware on Amazon and possibly other cloud servers. Last week security researchers from Kaspersky Lab found new variants of Mayday, a Trojan program for Linux that's used to launch distributed denial-of-service (DDoS) attacks. The malware supports several DDoS techniques, including DNS amplification. One of the new Mayday variants was found running on compromised Amazon EC2 server instances, but this is not the only platform being misused, said Kaspersky Lab researcher Kurt Baumgartner Friday in a blog post."
Android

Popular Android Apps Full of Bugs: Researchers Blame Recycling of Code 143

Posted by timothy
from the little-of-this-little-of-that dept.
New submitter Brett W (3715683) writes The security researchers that first published the 'Heartbleed' vulnerabilities in OpenSSL have spent the last few months auditing the Top 50 downloaded Android apps for vulnerabilities and have found issues with at least half of them. Many send user data to ad networks without consent, potentially without the publisher or even the app developer being aware of it. Quite a few also send private data across the network in plain text. The full study is due out later this week.
United States

When Spies and Crime-Fighters Squabble Over How They Spy On You 120

Posted by timothy
from the we-may-or-may-not-have-done-that dept.
The Washington Post reports in a short article on the sometimes strange, sometimes strained relationship between spy agencies like the NSA and CIA and law enforcement (as well as judges and prosecutors) when it comes to evidence gathered using technology or techniques that the spy agencies would rather not disclose at all, never mind explain in detail. They may both be arms of the U.S. government, but the spy agencies and the law enforcers covet different outcomes. From the article: [S]sometimes it's not just the tool that is classified, but the existence itself of the capability — the idea that a certain type of communication can be wiretapped — that is secret. One former senior federal prosecutor said he knew of at least two instances where surveillance tools that the FBI criminal investigators wanted to use "got formally classified in a big hurry" to forestall the risk that the technique would be revealed in a criminal trial. "People on the national security side got incredibly wound up about it," said the former official, who like others interviewed on the issue spoke on condition of anonymity because of the topic’s sensitivity. "The bottom line is: Toys get taken away and put on a very, very high shelf. Only people in the intelligence community can use them." ... The DEA in particular was concerned that if it came up with a capability, the National Security Agency or CIA would rush to classify it, said a former Justice Department official.
IOS

Private Data On iOS Devices Not So Private After All 100

Posted by timothy
from the it's-totally-intuitive dept.
theshowmecanuck (703852) writes with this excerpt from Reuters summarizing the upshot of a talk that Jonathan Zdziarski gave at last weekend's HOPE conference: Personal data including text messages, contact lists and photos can be extracted from iPhones through previously unpublicized techniques by Apple Inc employees, the company acknowledged this week. The same techniques to circumvent backup encryption could be used by law enforcement or others with access to the 'trusted' computers to which the devices have been connected, according to the security expert who prompted Apple's admission. Users are not notified that the services are running and cannot disable them, Zdziarski said. There is no way for iPhone users to know what computers have previously been granted trusted status via the backup process or block future connections. If you'd rather watch and listen, Zdziarski has posted a video showing how it's done.
Government

FBI Studied How Much Drones Impact Your Privacy -- Then Marked It Secret 138

Posted by timothy
from the awfully-suggestive dept.
v3rgEz writes When federal agencies adopt new technology, they're required by law to do Privacy Impact Assessments, which is exactly what the FBI did regarding its secretive drone program. The PIAs are created to help the public and federal government assess what they're risking through the adoption of new technology. That part is a little trickier, since the FBI is refusing to release any of the PIA on its drone project, stating it needs to be kept, er, private to protect national security.
Government

The NSA's New Partner In Spying: Saudi Arabia's Brutal State Police 125

Posted by Soulskill
from the with-friends-like-these dept.
Advocatus Diaboli sends this news from The Intercept: The National Security Agency last year significantly expanded its cooperative relationship with the Saudi Ministry of Interior, one of the world's most repressive and abusive government agencies. An April 2013 top secret memo provided by NSA whistleblower Edward Snowden details the agency's plans "to provide direct analytic and technical support" to the Saudis on "internal security" matters. The Saudi Ministry of Interior—referred to in the document as MOI— has been condemned for years as one of the most brutal human rights violators in the world. In 2013, the U.S. State Department reported that "Ministry of Interior officials sometimes subjected prisoners and detainees to torture and other physical abuse," specifically mentioning a 2011 episode in which MOI agents allegedly "poured an antiseptic cleaning liquid down [the] throat" of one human rights activist. The report also notes the MOI's use of invasive surveillance targeted at political and religious dissidents.
Encryption

New SSL Server Rules Go Into Effect Nov. 1 90

Posted by Soulskill
from the encrypt-your-calendars dept.
alphadogg writes: Public certificate authorities (CAs) are warning that as of Nov. 1 they will reject requests for internal SSL server certificates that don't conform to new internal domain naming and IP address conventions designed to safeguard networks. The concern is that SSL server digital certificates issued by CAs at present for internal corporate e-mail servers, Web servers and databases are not unique and can potentially be used in man-in-the-middle attacks involving the setup of rogue servers inside the targeted network, say representatives for the Certification Authority/Browser Forum (CA/B Forum), the industry group that sets security and operational guidelines for digital certificates. Members include the overwhelming bulk of public CAs around the globe, plus browser makers such as Microsoft and Apple. The problem today is that network managers often give their servers names like 'Server1' and allocate internal IP addresses so that SSL certificates issued for them through the public CAs are not necessarily globally unique, notes Trend Micro's Chris Bailey.
Space

How a Solar Storm Two Years Ago Nearly Caused a Catastrophe On Earth 212

Posted by Soulskill
from the call-ahead-before-dropping-by dept.
schwit1 writes: On July 23, 2012, the sun unleashed two massive clouds of plasma that barely missed a catastrophic encounter with the Earth's atmosphere. These plasma clouds, known as coronal mass ejections (CMEs), comprised a solar storm thought to be the most powerful in at least 150 years. "If it had hit, we would still be picking up the pieces," physicist Daniel Baker of the University of Colorado tells NASA. Fortunately, the blast site of the CMEs was not directed at Earth. Had this event occurred a week earlier when the point of eruption was Earth-facing, a potentially disastrous outcome would have unfolded.

"Analysts believe that a direct hit could cause widespread power blackouts, disabling everything that plugs into a wall socket. Most people wouldn't even be able to flush their toilet because urban water supplies largely rely on electric pumps. ... According to a study by the National Academy of Sciences, the total economic impact could exceed $2 trillion, or 20 times greater than the costs of a Hurricane Katrina. Multi-ton transformers damaged by such a storm might take years to repair." Steve Tracton put it this way in his frightening overview of the risks of a severe solar storm: "The consequences could be devastating for commerce, transportation, agriculture and food stocks, fuel and water supplies, human health and medical facilities, national security, and daily life in general."
Government

Social Security Administration Joins Other Agencies With $300M "IT Boondoggle" 142

Posted by Unknown Lamer
from the should-have-gone-into-government-IT dept.
alphadogg (971356) writes with news that the SSA has joined the long list of federal agencies with giant failed IT projects. From the article: "Six years ago the Social Security Administration embarked on an aggressive plan to replace outdated computer systems overwhelmed by a growing flood of disability claims. Nearly $300 million later, the new system is nowhere near ready and agency officials are struggling to salvage a project racked by delays and mismanagement, according to an internal report commissioned by the agency. In 2008, Social Security said the project was about two to three years from completion. Five years later, it was still two to three years from being done, according to the report by McKinsey and Co., a management consulting firm. Today, with the project still in the testing phase, the agency can't say when it will be completed or how much it will cost.
Privacy

Dutch Court Says Government Can Receive Bulk Data from NSA 109

Posted by Unknown Lamer
from the convenient-loophole dept.
jfruh (300774) writes Dutch law makes it illegal for the Dutch intelligence services to conduct mass data interception programs. But, according to a court in the Hague, it's perfectly all right for the Dutch government to request that data from the U.S.'s National Security Agency, and doing so doesn't violate any treaties or international law.
Security

Internet Explorer Vulnerabilities Increase 100% 137

Posted by samzenpus
from the protect-ya-neck dept.
An anonymous reader writes Bromium Labs analyzed public vulnerabilities and exploits from the first six months of 2014. The research determined that Internet Explorer vulnerabilities have increased more than 100 percent since 2013, surpassing Java and Flash vulnerabilities. Web browsers have always been a favorite avenue of attack, but we are now seeing that hackers are not only getting better at attacking Internet Explorer, they are doing it more frequently.
Security

The Psychology of Phishing 128

Posted by samzenpus
from the click-and-release dept.
An anonymous reader writes Phishing emails are without a doubt one of the biggest security issues consumers and businesses face today. Cybercriminals understand that we are a generation of clickers and they use this to their advantage. They will take the time to create sophisticated phishing emails because they understand that today users can tell-apart spam annoyances from useful email, however they still find it difficult identifying phishing emails, particularly when they are tailored to suit each recipient individually. Fake emails are so convincing and compelling that they fool 10% of recipients into clicking on the malicious link. To put that into context a legitimate marketing department at a FTSE 100 company typically expects less than a 2% click rate on their advertising campaigns. So, how are the cybercriminals out-marketing the marketing experts?
Data Storage

Intel Launches Self-Encrypting SSD 91

Posted by Soulskill
from the masochistic-storage-devices dept.
MojoKid writes: Intel just launched their new SSD 2500 Pro series solid state drive, the follow-up to last year's SSD 1500 Pro series, which targets corporate and small-business clients. The drive shares much of its DNA with some of Intel's consumer-class drives, but the Pro series cranks things up a few notches with support for advanced security and management features, low power states, and an extended management toolset. In terms of performance, the Intel SSD 2500 Pro isn't class-leading in light of many enthusiast-class drives but it's no slouch either. Intel differentiates the 2500 Pro series by adding support for vPro remote-management and hardware-based self-encryption. The 2500 Pro series supports TCG (Trusted Computing Group) Opal 2.0 features and is Microsoft eDrive capable as well. Intel also offers an administration tool for easy management of the drive. With the Intel administration tool, users can reset the PSID (physical presence security ID), though the contents of the drive will be wiped. Sequential reads are rated at up to 540MB/s, sequential writes at up to 480MB/s, with 45K – 80K random read / write IOps.
Government

The Department of Homeland Security Needs Its Own Edward Snowden 190

Posted by Soulskill
from the any-volunteers? dept.
blottsie writes: Out of all the U.S. government agencies, the Department of Homeland Security is one of the least transparent. As such, the number of Freedom of Information Act requests it receives have doubled since 2008. But the DHS has only become more adamant about blocking FOIA requests over the years. The problem has become so severe that nothing short of an Edward Snowden-style leak may be needed to increase transparency at the DHS.
AI

Researchers Design Bot To Conduct National Security Clearance Interviews 102

Posted by Unknown Lamer
from the why-do-you-say-you-are-not-a-threat-to-national-security? dept.
meghan elizabeth (3689911) writes Advancing a career in the U.S. government might soon require an interview with a computer-generated head who wants to know about that time you took ketamine. A recent study by psychologists at the National Center for Credibility Assessment, published in the journal Computers and Human Behavior, asserts that not only would a computer-generated interviewer be less "time consuming, labor intensive, and costly to the Federal Government," people are actually more likely to admit things to the bot. Eliza finds a new job.
Encryption

CNN iPhone App Sends iReporters' Passwords In the Clear 40

Posted by Unknown Lamer
from the safe-reporting dept.
chicksdaddy (814965) writes The Security Ledger reports on newly published research from the firm zScaler that reveals CNN's iPhone application transmits user login session information in clear text. The security flaw could leave users of the application vulnerable to having their login credential snooped by malicious actors on the same network or connected to the same insecure wifi hotspot. That's particularly bad news if you're one of CNN's iReporters — citizen journalists — who use the app to upload photos, video and other text as they report on breaking news events. According to a zScaler analysis, CNN's app for iPhone exposes user credentials in the clear both during initial setup of the account and in subsequent mobile sessions. The iPad version of the CNN app is not affected, nor is the CNN mobile application for Android. A spokesman for CNN said the company had a fix ready and was working with Apple to have it approved and released to the iTunes AppStore.

Real Programmers don't write in FORTRAN. FORTRAN is for pipe stress freaks and crystallography weenies. FORTRAN is for wimp engineers who wear white socks.

Working...