Alleged Dropbox Hack Is A Hoax, Website Is Back Up

<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody> <tr><td style="text-align: center;"><img border="0" height="361" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgVLB_Ce32VUcvKzM7HwXiBeTAPeZkhEFiHUe_o8voUrpo8Ve5DYd492d5jZFLDymIcOicqhsmKH5HF2ZT3nQG0FLuUNS3B8BmEqQCGQIEmH0nX9Cpk51oi3DjgHbdxT3Bhp1rZZMDza4c/s1600/dropbox.png" style="margin-left: auto; margin-right: auto;" width="640" /></td></tr> <tr><td class="tr-caption" style="text-align: center;"><i><span style="font-family: Georgia, Times New Roman, serif;">Dropbox</span></i></td></tr> </tbody></table> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgVLB_Ce32VUcvKzM7HwXiBeTAPeZkhEFiHUe_o8voUrpo8Ve5DYd492d5jZFLDymIcOicqhsmKH5HF2ZT3nQG0FLuUNS3B8BmEqQCGQIEmH0nX9Cpk51oi3DjgHbdxT3Bhp1rZZMDza4c/s1600/dropbox.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><span style="background-color: white; color: black; font-family: Georgia, Times New Roman, serif;"></span></a></div> <div style="box-sizing: border-box; line-height: 26px; margin-bottom: 1em; padding: 0px;"> <span style="background-color: white; font-family: Georgia, Times New Roman, serif;"><em style="box-sizing: border-box;">The alleged hack against Dropbox is <del style="box-sizing: border-box;">looking more like</del> is an elaborate hoax, timed perfectly with the website’s incidental outage. As security researcher Wesley Mcgrew <a href="https://twitter.com/McGrewSecurity/status/421845860616376320" style="box-sizing: border-box; outline: 0px; text-decoration: none;" target="_blank">points out</a></em>,<em style="box-sizing: border-box;">the emails supposedly stolen from Dropbox have been found elsewhere on the web and a<a href="https://twitter.com/YourAnonPriest" style="box-sizing: border-box; outline: 0px; text-decoration: none;" target="_blank">known</a> Anonymous Twitter account is officially denying their involvement. Moreover, it seems the group claiming credit <a href="https://twitter.com/YourAnonPriest/status/421857754920148993" style="box-sizing: border-box; outline: 0px; text-decoration: none;" target="_blank">may incur the wrath of Anonymous</a>, because they said the attack was in the name of fallen internet activist, Aaron Swartz. </em></span></div> <div style="box-sizing: border-box; line-height: 26px; margin-bottom: 1em; padding: 0px;"> <em style="box-sizing: border-box;"><span style="background-color: white; font-family: Georgia, Times New Roman, serif;">Dropbox sent us this updated response, confirming the hoax:</span></em></div> <div style="box-sizing: border-box; line-height: 26px; margin-bottom: 1em; padding: 0px;"> <em style="box-sizing: border-box;"><span style="background-color: white; font-family: Georgia, Times New Roman, serif;">“Dropbox site is back up.</span></em></div> <div style="box-sizing: border-box; line-height: 26px; margin-bottom: 1em; padding: 0px;"> <em style="box-sizing: border-box;"><span style="background-color: white; font-family: Georgia, Times New Roman, serif;">In regards to claims of “leaked user information” – this is a hoax. This is not Dropbox data. The list was published 12/9/13 at: <a href="http://pastebin.com/64PAAV1c" rel="nofollow" style="box-sizing: border-box; outline: 0px; text-decoration: none;">http://pastebin.com/64PAAV1c</a></span></em></div> <div style="box-sizing: border-box; line-height: 26px; margin-bottom: 1em; padding: 0px;"> <em style="box-sizing: border-box;"><span style="background-color: white; font-family: Georgia, Times New Roman, serif;">Today’s outage was caused during internal maintenance, and was not caused by external factors. We apologize for any inconvenience.”</span></em></div> <div style="box-sizing: border-box; line-height: 26px; margin-bottom: 1em; padding: 0px;"> <em style="box-sizing: border-box;"><span style="background-color: white; font-family: Georgia, Times New Roman, serif;">Our original story below:</span></em></div> <div style="box-sizing: border-box; line-height: 26px; margin-bottom: 1em; padding: 0px;"> <span style="background-color: white; font-family: Georgia, Times New Roman, serif;">Popular backup service Dropbox is offline and the hacktivist contingent, Anonymous, is claiming credit. “BREAKING NEWS: We have just compromised the @Dropbox Website<a href="http://bit.ly/1cMlbvt" rel="nofollow" style="box-sizing: border-box; outline: 0px; text-decoration: none;">http://bit.ly/1cMlbvt</a> #hacked #compromised,” tweeted an alleged Anonymous Twitter account.</span></div> <div style="box-sizing: border-box; line-height: 26px; margin-bottom: 1em; padding: 0px;"> <span style="background-color: white; font-family: Georgia, Times New Roman, serif;">Dropbox seems to be denying their website was hacked: “We are aware of an issue currently affecting the Dropbox site. We have identified the cause, which was the result of an issue that arose during routine internal maintenance, and are working to fix this as soon as possible. We apologize for any inconvenience,” went a company blog post. [<em style="box-sizing: border-box;">Update: Dropbox and has called us and is explicitly denying they have been hacked</em>] //<a href="http://techcrunch.com/2014/01/10/dropbox-offline-hacker-group-claims-credit/"> <i>TechCrunch</i></a></span></div>

Alleged Dropbox Hack Is A Hoax, Website Is Back Up

Dropbox The alleged hack against Dropbox is  looking more like  is an elaborate hoax, timed perfectly with the website’s incidental o...

Read more »

Judge rules NSA's phone data collection program is legal, tosses ACLU suit

<div class="imageContainer580xX" style="box-sizing: border-box; clear: both; color: #222222; font-family: 'Helvetica Neue', Arial, sans-serif; font-size: 14px; height: auto; line-height: 19px; margin: auto; width: 580px;"> <br /> <figure class="oneUp" id="page-lede" style="border: none; box-sizing: border-box; clear: both; margin: 0px 0px 35px; position: relative; text-align: center; width: 580px;"><img alt="nsa" class="galleryImage imgId100154862 " itemprop="image" src="http://zapt1.staticworld.net/images/article/2013/12/nsa-100154862-gallery.jpg" style="border: 0px; box-sizing: border-box; vertical-align: middle; width: 580px;" /></figure></div> <article style="background-color: white; box-sizing: border-box; color: #222222; font-family: 'Helvetica Neue', Arial, sans-serif; font-size: 15px; margin: 0px 15px; position: relative; z-index: 20;"> <span itemprop="articleBody description text" style="box-sizing: border-box;"><section class="page" style="box-sizing: border-box;"><div style="box-sizing: border-box; line-height: 1.7em; margin-bottom: 0.7em;"> A federal judge has ruled that the U.S. National Security Agency’s bulk phone record metadata collection efforts are legal, turning aside a lawsuit the American Civil Liberties Union brought against the agency.</div> <div style="box-sizing: border-box; line-height: 1.7em; margin-bottom: 0.7em;"> While the collection program “vacuums up information about virtually every call to, from, or within the United States,” it also allows the NSA to “detect relationship so attenuated and ephemeral they would otherwise escape notice,” Judge William Pauley III wrote in his 54-page decision filed Friday in U.S. District Court for the Southern District of New York.</div> <div style="box-sizing: border-box; line-height: 1.7em; margin-bottom: 0.7em;"> Overall, the metadata collection serves as the U.S. government’s “counter-punch: connecting fragmented and fleeting communications to re-construct and eliminate Al-Qaeda’s terror network,” Pauley wrote.</div> <div style="box-sizing: border-box; line-height: 1.7em; margin-bottom: 0.7em;"> There also is “no evidence that the Government has used any of the bulk telephony metadata it collected for any purpose other than investigating and disrupting terrorist attacks,” he added. “While there have been unintentional violations of guidelines, those appear to stem from human error and the incredibly complex computer programs that support this vital tool.”</div> <div style="box-sizing: border-box; line-height: 1.7em; margin-bottom: 0.7em;"> The ACLU plans to appeal the ruling, according to a statement it released Friday. “We are extremely disappointed with this decision, which misinterprets the relevant statutes, understates the privacy implications of the government’s surveillance and misapplies a narrow and outdated precedent to read away core constitutional protections,” ACLU deputy legal director Jameel Jaffer said in the statement.</div> <div style="box-sizing: border-box; line-height: 1.7em; margin-bottom: 0.7em;"> Details of the NSA’s domestic surveillance practices emerged this year through a series of disclosures by Edward Snowden, a former contractor for the agency. Snowden is now in temporary aslyum in Russia.</div> <div style="box-sizing: border-box; line-height: 1.7em; margin-bottom: 0.7em;"> Snowden’s actions, while unauthorized, have “provoked a public debate and this litigation,” Pauley said. The metadata collection program represents “the natural tension between protecting the nation and preserving civil liberty,” he wrote.</div> <div style="box-sizing: border-box; line-height: 1.7em; margin-bottom: 0.7em;"> <i>Via: <a href="http://www.pcworld.com/article/2083200/judge-rules-nsas-phone-data-collection-program-is-legal-tosses-aclu-suit.html">PCWorld</a></i></div> </section></span></article>

Judge rules NSA's phone data collection program is legal, tosses ACLU suit

A federal judge has ruled that the U.S. National Security Agency’s bulk phone record metadata collection efforts are legal, turning asi...

Read more »

Mobile gadgets security called biggest challenge for business

<div class="imageContainer580xX" style="box-sizing: border-box; clear: both; color: #222222; font-family: 'Helvetica Neue', Arial, sans-serif; font-size: 14px; height: auto; line-height: 19px; margin: auto; width: 580px;"> <figure class="oneUp" id="page-lede" style="border: none; box-sizing: border-box; clear: both; margin: 0px 0px 35px; position: relative; text-align: center; width: 580px;"><img alt="security" class="largeImage imgId100024955 " itemprop="image" src="http://zapt5.staticworld.net/images/article/2013/02/security_phone_laptops-100024955-large.jpg" style="border: 0px; box-sizing: border-box; vertical-align: middle; width: 580px;" /></figure></div> <article style="background-color: white; box-sizing: border-box; color: #222222; font-family: 'Helvetica Neue', Arial, sans-serif; font-size: 15px; margin: 0px 15px; position: relative; z-index: 20;"><div class="department" style="border-bottom-color: rgb(210, 210, 210); border-bottom-style: solid; border-bottom-width: 1px; border-top-color: rgb(210, 210, 210); border-top-style: solid; border-top-width: 1px; box-sizing: border-box; margin: 0px 0px 10px; overflow: hidden; padding: 7px 0px 0px;"> <br /></div> <span itemprop="articleBody description text" style="box-sizing: border-box;"><section class="page" style="box-sizing: border-box;"><div style="box-sizing: border-box; line-height: 1.7em; margin-bottom: 0.7em;"> Smartphones, tablets, and other mobile devices have become the target of malware and are even getting hit by highly targeted attacks known as “advanced persistent threats” that intended to steal sensitive data, according to a survey of 676 information technology and security professionals.</div> <div style="box-sizing: border-box; line-height: 1.7em; margin-bottom: 0.7em;"> About two-thirds of the respondents said the mobile endpoints used in their organizations had been hit by malware and 40 percent also said these endpoints were the entry point for an APT-style attack aimed at specific individuals to gain access to corporate information. The Ponemon Institute’s survey, titled “2014 State of Endpoint Risk”, states that on average 63 percent of an organization’s employees are <a href="http://www.pcworld.com/article/2082720/report-on-nsa-secret-payments-to-rsa-fuels-encryption-controversy.html?tk=rel_news" style="box-sizing: border-box; color: #25a7d7; text-decoration: none;">now using mobile devices,</a> with IT managers anticipating the number of devices that have to be actively managed will rise from 5000 on average to 7000 in the next three years.</div> <div style="box-sizing: border-box; line-height: 1.7em; margin-bottom: 0.7em;"> ”Just when many IT security practitioners were hoping to get their endpoint security risks under control, the exploding growth of mobility platforms and public cloud resources has turned these dreams into a security nightmare,” the survey report asserts. The respondents perceive “mobile devices such as smartphones” to be the <a href="http://www.pcworld.com/article/2029540/when-alien-hardware-invades-4-keys-to-byod-success.html?tk=rel_news" style="box-sizing: border-box; color: #25a7d7; text-decoration: none;">greatest potential security risk</a> in the IT environment, more than PC desktops and laptops.</div> <div style="box-sizing: border-box; line-height: 1.7em; margin-bottom: 0.7em;"> The survey, sponsored by Lumension, indicates that more than half of the IT security experts learned of APT attacks against endpoints when they found anomalous exfiltration traffic on the network. About a quarter said the endpoint security technology they use alerted them to a possible breach and 21 percent were notified by law enforcement directly. APT attacks often commence with phishing emails to employees, Web-based click-jacking, fraudulently signed code, or digital certificates, they said.</div> <div style="box-sizing: border-box; line-height: 1.7em; margin-bottom: 0.7em;"> As far as the applications considered to have the highest IT risk, the top three choices were: Adobe, Google Docs, and Microsoft's operating systems and applications.</div> <h2 style="box-sizing: border-box; font-family: facitweb, sans-serif; margin-bottom: 0.25em; margin-top: 1em;"> Personal gadgets in place at work</h2> <div style="box-sizing: border-box; line-height: 1.7em; margin-bottom: 0.7em;"> Just over half of the survey’s respondents say they have a “Bring Your Own Device” (BYOD) plan that lets employees use their own mobile devices for work purposes, and slightly over half of them are relying on “voluntarily installing the endpoint protection agent” for BYOD.</div> <div style="box-sizing: border-box; line-height: 1.7em; margin-bottom: 0.7em;"> The survey also asked about perceived risks associated with third-party cloud services, and 54 percent of the respondents said their organization has a “centralized cloud security policy,” up from 40 percent that did the year before.</div> <div style="box-sizing: border-box; line-height: 1.7em; margin-bottom: 0.7em;"> Having to focus more on endpoint security is putting pressure on IT security budgets, according to the report, with only 44 percent expecting their overall IT security budgets to increase in 2014.</div> <div style="box-sizing: border-box; line-height: 1.7em; margin-bottom: 0.7em;"> The types of technologies the survey’s respondent expect to invest in over the next year include application control, data-loss prevention, mobile device management (MDM), device control and “big data analytics.” The most important capabilities considered for MDM by the respondents are malware detection and prevention, provisioning, and access management.</div> <div style="box-sizing: border-box; line-height: 1.7em; margin-bottom: 0.7em;"> <i>Via: <a href="http://www.pcworld.com/article/2082225/mobile-gadgets-security-called-biggest-challenge-for-business.html">PCWolrd</a></i></div> </section></span></article>

Mobile gadgets security called biggest challenge for business

Smartphones, tablets, and other mobile devices have become the target of malware and are even getting hit by highly targeted attacks kn...

Read more »

Security industry takes a hit after latest NSA disclosures

<div class="imageContainer580xX" style="box-sizing: border-box; clear: both; color: #222222; font-family: 'Helvetica Neue', Arial, sans-serif; font-size: 14px; height: auto; line-height: 19px; margin: auto; width: 580px;"> <br /> <figure class="oneUp" id="page-lede" style="border: none; box-sizing: border-box; clear: both; margin: 0px 0px 35px; position: relative; text-align: center; width: 580px;"><img class="galleryImage imgId100053240 " itemprop="image" src="http://zapt5.staticworld.net/images/article/2013/09/privacy_nsa_security-100053240-gallery.jpg" style="border: 0px; box-sizing: border-box; vertical-align: middle; width: 580px;" /></figure></div> <br /> <article style="background-color: white; box-sizing: border-box; color: #222222; font-family: 'Helvetica Neue', Arial, sans-serif; font-size: 15px; margin: 0px 15px; position: relative; z-index: 20;"><div class="department" style="box-sizing: border-box; margin: 0px 0px 10px; overflow: hidden;"> <br /></div> <span itemprop="articleBody description text" style="box-sizing: border-box;"><section class="page" style="box-sizing: border-box;"><div style="box-sizing: border-box; line-height: 1.7em; margin-bottom: 0.7em;"> Trust in the security industry has taken a blow with a recent report that RSA was paid by the U.S. National Security Agency to provide a way to crack its encryption.</div> <div style="box-sizing: border-box; line-height: 1.7em; margin-bottom: 0.7em;"> RSA denies the Reuters <a href="http://www.reuters.com/article/2013/12/20/us-usa-security-rsa-idUSBRE9BJ1C220131220" style="box-sizing: border-box; color: #25a7d7; text-decoration: none;">report</a> published Friday that said the NSA paid RSA $10 million to use a flawed encryption formula. The agency-developed Dual Elliptic Curve Deterministic Random Bit Generator (Dual EC DRBG) was used in RSA’s BSAFE product.</div> <div style="box-sizing: border-box; line-height: 1.7em; margin-bottom: 0.7em;"> The report shook up the security industry, because of RSA’s influence. The company’s annual user conference in San Francisco is one of the largest security events of the year. On Monday, Mikko Hypponen, a widely know security expert, sent a letter to RSA<a href="http://blogs.csoonline.com/executive-communication/2890/noted-speaker-mikko-hypponen-cancels-rsa-talk-protest" style="box-sizing: border-box; color: #25a7d7; text-decoration: none;">cancelling his talk</a> for the 2014 RSA Conference, because of RSA’s dealings with the NSA.</div> <div style="box-sizing: border-box; line-height: 1.7em; margin-bottom: 0.7em;"> In a statement released last week, RSA said, “We categorically deny this allegation.”</div> <div style="box-sizing: border-box; line-height: 1.7em; margin-bottom: 0.7em;"> The company went on to say that it had “never entered into any contract or engaged in any project with the intention of weakening RSA’s products, or introducing potential ‘backdoors’ into our products for anyones use.”</div> <div style="box-sizing: border-box; line-height: 1.7em; margin-bottom: 0.7em;"> Nevertheless, RSA failed to sway some security experts. “RSA’s response has not instilled confidence in much of the security community,” Carl Livitt, managing security associate for consulting firm Bishop Fox, said.</div> <div style="box-sizing: border-box; line-height: 1.7em; margin-bottom: 0.7em;"> ”RSA’s response is very cagey and blatantly ignores big, important questions,” he said.</div> <h2 style="box-sizing: border-box; font-family: facitweb, sans-serif; margin-bottom: 0.25em; margin-top: 1em;"> Can security firms be trusted?</h2> <div style="box-sizing: border-box; line-height: 1.7em; margin-bottom: 0.7em;"> Matthew Green, a well-known cryptographer and assistant research professor at Johns Hopkins University, said the RSA revelation has threatened the reputation of the security industry.</div> <div style="box-sizing: border-box; line-height: 1.7em; margin-bottom: 0.7em;"> ”Most of the people I’ve spoken to agree that from our point of view, this is like you are a doctor trying to heal patients and you find out someone is making them sick on purpose,” he said. “I think you’d be pretty upset about it.”</div> <div style="box-sizing: border-box; line-height: 1.7em; margin-bottom: 0.7em;"> Green said the job of security professionals is to make products secure, and the thought of a government agency purposely breaking them is upsetting.</div> <div style="box-sizing: border-box; line-height: 1.7em; margin-bottom: 0.7em;"> ”It makes me pretty angry,” he said.</div> <div style="box-sizing: border-box; line-height: 1.7em; margin-bottom: 0.7em;"> Also last week, an independent White House Panel released a <a href="http://www.washingtonpost.com/politics/obama-concludes-tough-year-with-press-conference/2013/12/20/7840204c-6991-11e3-a0b9-249bbb34602c_story.html" style="box-sizing: border-box; color: #25a7d7; text-decoration: none;">report</a> that questioned whether the NSA’s massive data collection, brought to light by documents from ex-NSA contractor Edward Snowden, was necessary to prevent terrorist attacks, as the agency claims.</div> <div style="box-sizing: border-box; line-height: 1.7em; margin-bottom: 0.7em;"> The documents Snowden released to select media described information gathering from Internet and telecommunication companies on Americans and foreigners, including leaders in other countries.</div> <div style="box-sizing: border-box; line-height: 1.7em; margin-bottom: 0.7em;"> Within the panel’s list of recommendations was one that said efforts to undermine cryptography should be discarded.</div> <div style="box-sizing: border-box; line-height: 1.7em; margin-bottom: 0.7em;"> <i>Via: <a href="http://www.pcworld.com/article/2083243/security-industry-takes-a-hit-after-latest-nsa-disclosures.html">PCWorld</a></i></div> </section></span></article>

Security industry takes a hit after latest NSA disclosures

Trust in the security industry has taken a blow with a recent report that RSA was paid by the U.S. National Security Agency to provid...

Read more »

Snapchat ignored security hole that lets hackers access

<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody> <tr><td style="text-align: center;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjfssT1I1ykntfLVSgFSoo0M_HDXAKDbucuk9N47gXd9oEa7etYEJSS_bz9B1wLGuW0tDezLX6qYKD2kRwxuMpH0RuUhmIgIM41e2uAAsDVJsaOsy2Yl-Pb6xL67gwwkI9kNfa-v0w39Xc/s1600/security.jpg" style="margin-left: auto; margin-right: auto;" /></td></tr> <tr><td class="tr-caption" style="text-align: center;"><i>Snapchat</i></td></tr> </tbody></table> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjfssT1I1ykntfLVSgFSoo0M_HDXAKDbucuk9N47gXd9oEa7etYEJSS_bz9B1wLGuW0tDezLX6qYKD2kRwxuMpH0RuUhmIgIM41e2uAAsDVJsaOsy2Yl-Pb6xL67gwwkI9kNfa-v0w39Xc/s1600/security.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><span style="color: black; font-family: Georgia, Times New Roman, serif;"></span></a></div> <div style="background-color: white; border: 0px; box-sizing: border-box; line-height: 23px; padding: 0px 0px 14px; vertical-align: baseline;"> <span style="font-family: Georgia, Times New Roman, serif;">Hackers could gain access to the phone numbers and names of the app's users because of a loophole in its coding and API (application programming interface), a <a href="http://gibsonsec.org/snapchat/" style="border: 0px; box-sizing: border-box; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;" target="_blank">new report</a> from online security firm Gibson Security has revealed.</span></div> <div style="background-color: white; border: 0px; box-sizing: border-box; line-height: 23px; padding: 0px 0px 14px; vertical-align: baseline;"> <span style="font-family: Georgia, Times New Roman, serif;">Snapchat were made aware of this security glitch in August, but ignored it.</span></div> <div style="background-color: white; border: 0px; box-sizing: border-box; line-height: 23px; padding: 0px 0px 14px; vertical-align: baseline;"> <span style="font-family: Georgia, Times New Roman, serif;">Gibson Security claim users of the photo messaging application would have their names, aliases and phone numbers discovered via the Snapchat and iOS API - even if the user's account is private, reports <a href="http://www.zdnet.com/researchers-publish-snapchat-code-allowing-phone-number-matching-after-exploit-disclosures-ignored-7000024629/" style="border: 0px; box-sizing: border-box; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;" target="_blank">ZDnet</a>.</span></div> <div style="background-color: white; border: 0px; box-sizing: border-box; line-height: 23px; padding: 0px 0px 14px; vertical-align: baseline;"> <span style="font-family: Georgia, Times New Roman, serif;">Gibson Security told ZDNet that hackers could "automatically build profiles about users, which could be sold for a lot of money."</span></div> <div style="background-color: white; border: 0px; box-sizing: border-box; line-height: 23px; padding: 0px 0px 14px; vertical-align: baseline;"> <span style="font-family: Georgia, Times New Roman, serif;">He added: "People could operate a service similar to ssndob.cc , where you could pay a few dollars and obtain the phone number and social media profiles of a person, just by their username."</span></div> <div style="background-color: white; border: 0px; box-sizing: border-box; line-height: 23px; padding: 0px 0px 14px; vertical-align: baseline;"> <span style="font-family: Georgia, Times New Roman, serif;">But his "biggest worry" is that his could also be used to targeted scamming and stalking</span></div> <div style="background-color: white; border: 0px; box-sizing: border-box; line-height: 23px; padding: 0px 0px 14px; vertical-align: baseline;"> <span style="font-family: Georgia, Times New Roman, serif;">"You could find someone's phone number in minutes provided you know the general area they live in," he said.</span></div> <div style="background-color: white; border: 0px; box-sizing: border-box; line-height: 23px; padding: 0px 0px 14px; vertical-align: baseline;"> <span style="font-family: Georgia, Times New Roman, serif;">The photo messaging app allows users to send photos and videos which can only be viewed for 10 seconds, and then vanish once they are opened.</span></div> <div style="background-color: white; border: 0px; box-sizing: border-box; line-height: 23px; padding: 0px 0px 14px; vertical-align: baseline;"> <span style="font-family: Georgia, Times New Roman, serif;">Snapchat turned down a $3 billion buyout offer from Facebook in November, which Gibson Security says provides further proof of the value of selling a user profile database.</span></div> <div style="background-color: white; border: 0px; box-sizing: border-box; line-height: 23px; padding: 0px 0px 14px; vertical-align: baseline;"> <span style="font-family: Georgia, Times New Roman, serif;">Source : <a href="http://www.news.com.au/technology/online/snapchat-ignored-security-hole-that-lets-hackers-identify-phone-numbers/story-fnjwnfzw-1226790834338?from=public_rss">News.com.au</a></span></div> <div style="background-color: white; border: 0px; box-sizing: border-box; color: #333333; font-family: LiberationSerifRegular, 'Times New Roman', Times, serif; font-size: 19px; line-height: 23px; padding: 0px 0px 14px; vertical-align: baseline;"> <br /></div>

Snapchat ignored security hole that lets hackers access

Snapchat Hackers could gain access to the phone numbers and names of the app's users because of a loophole in its coding and API ...

Read more »

Apple rejected Encrypted chat service Cryptocat for iPhone

<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody> <tr><td style="text-align: center;"><img border="0" height="495" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi4D2qL-wGkfqdaQns8NYDlGYHDqujTahRmpkUT8bj5k52YuPOPKImUm32Xyme1im0rFiGP1uVLSmNcISttWMhn1QUYXxHQSdHf1jhN5beX4Zmk2E3pYlb7h5KuzEEVCbLz_0lFmqG1xhk/s640/apple-ios-7-iphone.jpg" style="margin-left: auto; margin-right: auto;" width="640" /></td></tr> <tr><td class="tr-caption" style="text-align: center;"><i> iPhone</i></td></tr> </tbody></table> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi4D2qL-wGkfqdaQns8NYDlGYHDqujTahRmpkUT8bj5k52YuPOPKImUm32Xyme1im0rFiGP1uVLSmNcISttWMhn1QUYXxHQSdHf1jhN5beX4Zmk2E3pYlb7h5KuzEEVCbLz_0lFmqG1xhk/s1600/apple-ios-7-iphone.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><span style="font-family: Georgia, Times New Roman, serif;"></span></a></div> <span style="font-family: Georgia, Times New Roman, serif;">Encrypted chat service Cryptocat has spent the past two years blocking outsiders from reading private conversations, and now it's facing a block of its own trying to get onto Apple's App Store. Developer Nadim Kobeissi took to Twitter today to blast the iPhone and iPad maker for unjustly rejecting Cryptocat for iPhone, software that was announced earlier this month. Kobeissi says he's under a non-disclosure agreement as part of the Apple developer program and cannot go into specifics, but claims that the reasons the company gave for its rejection were "illegitimate," and could threaten similar apps. "One of the reasons for Cryptocat for iPhone's rejection by Apple strongly implies that any other encrypted group chat app can be rejected," Kobeissi said in a follow-up tweet.</span><br /> <span style="font-family: Georgia, Times New Roman, serif;"><br /></span> <span style="font-family: Georgia, Times New Roman, serif;">Cryptocat made waves for offering a simple way to let two people chat while using end-to-end encryption. The service gained international attention (and some notoriety) in light of government eavesdropping, and its use in countries where free speech was limited. That's come with some costs: Kobeissi says he's gone through extra security screenings when traveling; and fearing intrusion from the Canadian government earlier this year, he moved Cryptocat's entire network to a Swedish nuclear bunker.</span><br /> <span style="font-family: Georgia, Times New Roman, serif;"><br /></span> <span style="font-family: Georgia, Times New Roman, serif;">One thing that makes all this curious is that Cryptocat's already available on Apple's App Store for OS X, which has similar content guideline requirements. Developers need to meet those rules before software can be distributed to users, though unlike on desktop machines, Apple does not allow users to buy or install software from elsewhere on iOS. </span><br /> <i><span style="font-family: Georgia, Times New Roman, serif;">Via :  <a href="http://www.theverge.com/2013/12/27/5249402/encrypted-chat-service-cryptocat-for-iphone-rejected-by-apple">The Verge</a></span></i><br /> <i><span style="font-family: Georgia, Times New Roman, serif;">Image Credit :  <a href="https://twitter.com/cryptocatapp/status/403936414414696448/photo/1">CryptoCat (Twitter)</a></span></i>

Apple rejected Encrypted chat service Cryptocat for iPhone

 iPhone Encrypted chat service Cryptocat has spent the past two years blocking outsiders from reading private conversations, and now i...

Read more »

Federal judge rules for NSA phone surveillance legal

<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody> <tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg5tDN0QgPFHfNstdraQ7_owH1tzsjLamrYczinlWgWpbklaGpkzhiiACUrm5mphPH4tL1_NacXs67bAAWCGiNVlRCJku91NzhIBY5VQU-2zEZAFd_89UzYI0LyUByRplbB2siiR617ql4/s1600/nsa.jpeg" imageanchor="1" style="margin-left: auto; margin-right: auto;"><span style="font-family: Georgia, Times New Roman, serif;"><img border="0" height="420" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg5tDN0QgPFHfNstdraQ7_owH1tzsjLamrYczinlWgWpbklaGpkzhiiACUrm5mphPH4tL1_NacXs67bAAWCGiNVlRCJku91NzhIBY5VQU-2zEZAFd_89UzYI0LyUByRplbB2siiR617ql4/s640/nsa.jpeg" width="640" /></span></a></td></tr> <tr><td class="tr-caption" style="text-align: center;"><i><span style="font-family: Georgia, Times New Roman, serif; font-size: small;">NSA</span></i></td></tr> </tbody></table> <span style="font-family: Georgia, Times New Roman, serif;">The ruling Friday by U.S. District Judge William H. Pauley III and the opposing view earlier this month by U.S. District Judge Richard Leon in Washington, D.C., sets the stage for federal appeals courts to contemplate the delicate balance between individual rights set out in the Constitution and the need to protect national security.</span><br /> <span style="font-family: Georgia, Times New Roman, serif;"><br /></span> <span style="font-family: Georgia, Times New Roman, serif;">Pauley concluded the program was a necessary extension of steps taken after the Sept. 11 terrorist attacks. He said the program lets the government connect fragmented and fleeting communications and "represents the government's counter-punch" to the al-Qaida's terror network's use of technology to operate decentralized and plot international terrorist attacks remotely.</span><br /> <span style="font-family: Georgia, Times New Roman, serif;"><br /></span> <span style="font-family: Georgia, Times New Roman, serif;">"This blunt tool only works because it collects everything," Pauley said. "The collection is broad, but the scope of counterterrorism investigations is unprecedented."</span><br /> <span style="font-family: Georgia, Times New Roman, serif;"><br /></span> <span style="font-family: Georgia, Times New Roman, serif;">Pauley's decision contrasts with Leon's grant of a preliminary injunction against the collection of phone records of two men who had challenged the program. The Washington, D.C., jurist said the program likely violates the U.S. Constitution's ban on unreasonable search. The judge has since stayed the effect of his ruling, pending a government appeal.</span><br /> <span style="font-family: Georgia, Times New Roman, serif;"><br /></span> <span style="font-family: Georgia, Times New Roman, serif;">Both cases now move to appeals courts and a conflict that some believe will eventually be settled by the Supreme Court. The chances that the nation's top court will address the issue increase if the appeals courts reach differing opinions or if the current use of the program is declared illegal.</span><br /> <span style="font-family: Georgia, Times New Roman, serif;"><br /></span> <span style="font-family: Georgia, Times New Roman, serif;">In ruling, Pauley dismissed a lawsuit brought by the American Civil Liberties Union earlier this year after former NSA analyst Edward Snowden leaked details of the secret programs that critics say violate privacy rights. The NSA-run programs pick up millions of telephone and Internet records that are routed through American networks each day.</span><br /> <span style="font-family: Georgia, Times New Roman, serif;">Source : <a href="http://www.kansascity.com/2013/12/28/4716654/nsa-phone-surveillance-legal-federal.html">KansasCity</a></span>

Federal judge rules for NSA phone surveillance legal

NSA The ruling Friday by U.S. District Judge William H. Pauley III and the opposing view earlier this month by U.S. District Judge Richa...

Read more »

Are Samsung Smartphones Seriously safe?

<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody> <tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjWhkJ7pUnhsAe5lP-5oju4BVyCOanM-S1WWJ-nK3pvarhZXuz73SBxsK35Fkku3s-IcLkgCxxNogc6ovbLIEDH6kqNp5lI6lfIvHH-8BvUynJXDMRiyx5BM7Ke0fj4tKCttIwE8_Md39Q/s1600/img_knox_02.jpg" imageanchor="1" style="margin-left: auto; margin-right: auto;"><span style="background-color: white; color: black; font-family: Georgia, Times New Roman, serif;"><img border="0" height="321" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjWhkJ7pUnhsAe5lP-5oju4BVyCOanM-S1WWJ-nK3pvarhZXuz73SBxsK35Fkku3s-IcLkgCxxNogc6ovbLIEDH6kqNp5lI6lfIvHH-8BvUynJXDMRiyx5BM7Ke0fj4tKCttIwE8_Md39Q/s640/img_knox_02.jpg" width="640" /></span></a></td></tr> <tr><td class="tr-caption" style="text-align: center;"><span style="background-color: white; line-height: 21.99652862548828px; text-align: start;"><span style="font-family: Georgia, Times New Roman, serif; font-size: small;">A serious security vulnerability was reportedly found in Samsung’s smartphone app Knox</span></span></td></tr> </tbody></table> <div style="border: 0px; line-height: 22px; margin-bottom: 1em; padding: 0px;"> <span style="background-color: white; font-family: Georgia, Times New Roman, serif;">The Wall Street Journal (WSJ) reported on December 24 that a serious security vulnerability was found in Samsung’s smartphone app Knox.</span></div> <div style="border: 0px; line-height: 22px; margin-bottom: 1em; margin-top: 1em; padding: 0px;"> <span style="background-color: white; font-family: Georgia, Times New Roman, serif;">Mordechai Guri, a researcher at Israel’s  Ben-Gurion University’s Cyber Lab, alleged that a critical security vulnerability was discovered earlier this month, which would allow outsiders to breach the smartphone’s security and access supposedly secure user data.  </span></div> <div style="border: 0px; line-height: 22px; margin-bottom: 1em; margin-top: 1em; padding: 0px;"> <span style="background-color: white; font-family: Georgia, Times New Roman, serif;">The Knox app is designed to protect corporate data on a personal smartphone, data such as email, contacts, and calendr information. But in a worst-case scenario, hackers could install a Trojan on a Knox-enabled phone that could enter the corporate security network via the Knox app and wreak havoc. </span></div> <div style="border: 0px; line-height: 22px; margin-bottom: 1em; margin-top: 1em; padding: 0px;"> <span style="background-color: white; font-family: Georgia, Times New Roman, serif;">Samsung is reportedly conducting its own investigation, but announced that similar allegations have been made before, and that the problem is not as serious as Guri claims.</span></div> <div style="border: 0px; line-height: 22px; margin-bottom: 1em; margin-top: 1em; padding: 0px;"> <span style="background-color: white; font-family: Georgia, Times New Roman, serif;">Samsung also argued that in order to run Knox properly there must be additional software installed, but the lab’s testing was done without the required software.</span></div> <div style="border: 0px; line-height: 22px; margin-bottom: 1em; margin-top: 1em; padding: 0px;"> <span style="background-color: white; font-family: Georgia, Times New Roman, serif;">The WSJ also reported earlier this month that system errors have been repeatedly found in Knox, prompting consumer complaints. // businesskorea.co.kr</span></div>

Are Samsung Smartphones Seriously safe?

A serious security vulnerability was reportedly found in Samsung’s smartphone app Knox The Wall Street Journal (WSJ) reported on Decemb...

Read more »

Evasi0n Jailbreak Group Drops Pirate App Store TaiG

<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody> <tr><td style="text-align: center;"><i><img alt="Evasi0n Jailbreak Group Drops Pirate App Store TaiG" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgOv7hignoE3c1Tnyti8tXbRAbmTFYkkZGU67SbfyG-cZgELCeIAwAO1WSN998sb7ZRby2UfHsuPguWsWxDEAiYLwTAQb0eu8jV7sXTJtKvJFZUqtMgeIRcuUYN9r0j2tekSebWNHcJqm8/s1600/jailbreaker.jpg" style="margin-left: auto; margin-right: auto;" title="" /></i></td></tr> <tr><td class="tr-caption" style="text-align: center;"><i>Evasi0n Jailbreak Group Drops Pirate App Store TaiG</i></td></tr> </tbody></table> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgOv7hignoE3c1Tnyti8tXbRAbmTFYkkZGU67SbfyG-cZgELCeIAwAO1WSN998sb7ZRby2UfHsuPguWsWxDEAiYLwTAQb0eu8jV7sXTJtKvJFZUqtMgeIRcuUYN9r0j2tekSebWNHcJqm8/s1600/jailbreaker.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><span style="background-color: white; color: black; font-family: Georgia, Times New Roman, serif;"></span></a></div> <div style="box-sizing: border-box; line-height: 26px; margin-bottom: 1em; padding: 0px;"> <span style="background-color: white; font-family: Georgia, Times New Roman, serif;">In a short letter to the jailbreak community, the <a href="http://evasi0n.com/l2.html" style="box-sizing: border-box; outline: 0px; text-decoration: none;" target="_blank">Evasi0n group has announced</a> they are refusing to distribute TaiG, a Chinese app store released alongside an iOS 7.x jailbreak.Users found that the app store contained hundreds of pirated apps.</span></div> <div style="box-sizing: border-box; line-height: 26px; margin-bottom: 1em; padding: 0px;"> <span style="background-color: white; font-family: Georgia, Times New Roman, serif;">Evasi0n said they “dropped the ball” and that the TaiG partnership was a mistake.</span></div> <div style="border-left-color: rgb(204, 204, 204); border-left-style: solid; border-left-width: 3px; box-sizing: border-box; font-style: italic; line-height: 26px; margin: 0px 30px; padding: 0px 0px 0px 15px;"> <span style="background-color: white; font-family: Georgia, Times New Roman, serif;">We terminated our relationship with them. We are very disappointed that they have decided to put up a cracked version of the jailbreak on their site that installs Taig. We did not give them any permission or source code.</span></div> <div style="box-sizing: border-box; line-height: 26px; margin-bottom: 1em; padding: 0px;"> <span style="background-color: white; font-family: Georgia, Times New Roman, serif;">They also reverse-engineered the software to assess how TaiG handled user privacy, finding that the software sent no private data and that the software sent unique identifiers in encrypted form. Noted <a href="http://techcrunch.com/2013/12/22/partnership-with-chinese-app-store-shines-a-light-on-the-hidden-world-of-jailbreak-groups/" style="box-sizing: border-box; outline: 0px; text-decoration: none;">home-brew app developer Jay Freeman</a> confirmed that Evasi0n was to receive at least $1 million from TaiG, although the actual sum was not disclosed.</span></div> <div style="box-sizing: border-box; line-height: 26px; margin-bottom: 1em; padding: 0px;"> <span style="background-color: white; font-family: Georgia, Times New Roman, serif;">The group has also announced that they are not accepting cash from TaiG:</span></div> <div style="border-left-color: rgb(204, 204, 204); border-left-style: solid; border-left-width: 3px; box-sizing: border-box; font-style: italic; line-height: 26px; margin: 0px 30px; padding: 0px 0px 0px 15px;"> <span style="background-color: white; font-family: Georgia, Times New Roman, serif;">There have been a lot of rumors listing various amounts we’ve been paid. We have received no monies from any group, including Taig. We will not be accepting any money. Our donations are being given to Public Knowledge, Electronic Frontier Foundation and Foundation for a Free Information Infrastructure to help protect jailbreaking as your legal right.</span></div> <div style="border-left-color: rgb(204, 204, 204); border-left-style: solid; border-left-width: 3px; box-sizing: border-box; font-style: italic; line-height: 26px; margin: 0px 30px; padding: 0px 0px 0px 15px;"> <span style="background-color: white; font-family: Georgia, Times New Roman, serif;"><br /></span></div> <div style="border-left-color: rgb(204, 204, 204); border-left-style: solid; border-left-width: 3px; box-sizing: border-box; font-style: italic; line-height: 26px; margin: 0px 30px; padding: 0px 0px 0px 15px;"> <span style="background-color: white; font-family: Georgia, Times New Roman, serif;">Via : <a href="http://techcrunch.com/2013/12/25/evasi0n-jailbreak-group-drops-pirate-app-store-taig/">TechCrunch</a></span></div>

Evasi0n Jailbreak Group Drops Pirate App Store TaiG

Evasi0n Jailbreak Group Drops Pirate App Store TaiG In a short letter to the jailbreak community, the  Evasi0n group has announced  t...

Read more »

Evasi0n Jailbreak for iOS7 comes with support for Chinese market

<div class="separator" style="clear: both; text-align: center;"><span style="font-size: small;"><span style="font-family: Georgia,"Times New Roman",serif;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhNIUV6hHWvNK6WU4CUfiQUF3YLRjQMDYOs9XQ_V-1uonCmHVbvWlKfEIcvD_GjgBpQ4GVyl6AsB7_rqo9V7JCVAsy7uqHzDwzgRwe61qvdSDYRIBfC_aZpsCBPatlqxo_8syzlVYdl926I/s1600/Evasi0n-sfondo-iPad-Mini-iPad2-590x330.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="178" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhNIUV6hHWvNK6WU4CUfiQUF3YLRjQMDYOs9XQ_V-1uonCmHVbvWlKfEIcvD_GjgBpQ4GVyl6AsB7_rqo9V7JCVAsy7uqHzDwzgRwe61qvdSDYRIBfC_aZpsCBPatlqxo_8syzlVYdl926I/s320/Evasi0n-sfondo-iPad-Mini-iPad2-590x330.jpg" width="320" /></a></span></span></div><span style="font-size: small;"><span style="font-family: Georgia,"Times New Roman",serif;">Knowing that a jailbreak for iOS 7 was coming eventually, especially after talking to Saurik about it not all that long ago during an interview, sure didn’t make the wait seem any less eternal. While Apple’s latest update to iOS added a lot of things that jailbreakers typically install once they are allowed to, there will likely never be time when it will be totally unnecessary to jailbreak for some people. Fortunately, and seemingly out of nowhere, the evasi0n team came through and delivered an update to their very simple tool for freeing your iDevice. </span></span><br /><span style="font-size: small;"><span style="font-family: Georgia,"Times New Roman",serif;"></span></span><span style="font-size: small;"><span style="font-family: Georgia,"Times New Roman",serif;">If you are running any current version of iOS 7, you’ll be able to take advantage of this tool. All you need to do is plug in, to your computer, disable your lock screen, run the program, and when all is said and done you’ll be jailbroken. Unfortunately the evasi0n team didn’t see fit to work with Saurik to include an updated version of Cydia or MobileSubstrate, but a quick glance at his twitter feed shows that the wait won’t be terribly long for those things. </span></span><br /><span style="font-size: small;"><span style="font-family: Georgia,"Times New Roman",serif;"></span></span><table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody><tr><td style="text-align: center;"><img alt="evasi0n" class="alignnone size-medium wp-image-1580406" height="284" src="http://www.geek.com/wp-content/uploads/2013/12/Screen-Shot-2013-12-23-at-7.14.13-AM-590x284.png" style="margin-left: auto; margin-right: auto;" width="590" /></td></tr><tr><td class="tr-caption" style="text-align: center;"><i>Evasi0n Jailbreak for iOS7</i></td></tr></tbody></table><span style="font-size: small;"><span style="font-family: Georgia,"Times New Roman",serif;"></span></span><br /><span style="font-size: small;"><span style="font-family: Georgia,"Times New Roman",serif;"></span></span><span style="font-size: small;"><span style="font-family: Georgia,"Times New Roman",serif;">This jailbreak from evasi0n includes something new for Chinese markets. Instead of Cydia, these users will have access to the all Chinese TaiG store. It is designed to offer services and apps that are more relevant in those parts of the world, much in the same way the CyanogenMod team intends to do soon with Tencent in the future. Some early poking around in this new store revealed some pirated apps, but the evasi0n team <a href="http://evasi0n.com/l.html">wrote a separate post</a> explaining to everyone their plans for dealing with those apps moving forward. </span></span><br /><span style="font-size: small;"><span style="font-family: Georgia,"Times New Roman",serif;"></span></span><span style="font-size: small;"><span style="font-family: Georgia,"Times New Roman",serif;">If you’re all set to joilbreak, all of the tools are there for you to jump in and enjoy. If you’re more interested in waiting for Cydia to be updated and bugfixed, keep an eye on <a href="https://twitter.com/saurik">Saurik’s twitter account</a> for more details.</span></span><br /><span style="font-size: small;"><span style="font-family: Georgia,"Times New Roman",serif;"><i>via : <a href="http://www.geek.com/apple/evasi0n-jailbreak-for-ios7-lands-with-support-for-chinese-markets-1580404/">Geek.com </a></i></span></span>

Evasi0n Jailbreak for iOS7 comes with support for Chinese market

Knowing that a jailbreak for iOS 7 was coming eventually, especially after talking to Saurik about it not all that long ago during an inter...

Read more »

Activate Apple iSight webcams without warning light

<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj7zJne6h71ygMqq41AjLAl65JYdwLoUstyaoS6c3Iwd1F6d2bDmeXGHCug4t031YTpRfh344pwnFt0pMmDfF_g1guDosI4q9mnQoWV2c1k8YkEOzv4X8hsBR0G4nCrTR81u2WtUvu3XmFd/s1600/art-features_display_main-620x349.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><span style="color: black; font-family: Verdana, sans-serif;"></span></a></div><div style="border: 0px; line-height: 17px; padding: 0px; vertical-align: baseline;"><span style="font-family: Verdana, sans-serif;">he woman was shocked when she received two nude photos of herself by email. The photos had been taken over a period of several months – without her knowledge – by the built-in camera on her laptop.</span></div><blockquote class="cN-quote" style="border: 0px; clear: right; line-height: 17px; margin: 0.667em 0.667em 1.8em; padding: 0px; position: relative; quotes: ''; vertical-align: baseline;"><div style="background-image: url(http://resources.smh.com.au/common/media-common-1.0/css/output/7.33.3/common.skin.article.css/img/sprite-skin-article-new.png); background-position: -664px -241px; border: 0px; font-style: italic; line-height: normal; margin-bottom: 0.6em; margin-top: 1em; padding: 0px 0px 0px 1.33em; vertical-align: baseline;"><span style="font-family: Verdana, sans-serif;">The safest thing to do is to put a piece of tape on your camera.<span style="background-image: url(http://resources.smh.com.au/common/media-common-1.0/css/output/7.33.3/common.skin.article.css/img/sprite-skin-article-new.png); background-position: -639px -241px; border: 0px; bottom: -6px; display: inline-block; font-style: inherit; font-weight: inherit; height: 16px; margin: 0px 0px 0px 0.2em; padding: 0px; position: relative; vertical-align: baseline; width: 22px;"> </span></span></div></blockquote><table cellpadding="0" cellspacing="0" class="tr-caption-container" style="float: left; text-align: center;"><tbody><tr><td style="text-align: center;"><img border="0" height="180" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj7zJne6h71ygMqq41AjLAl65JYdwLoUstyaoS6c3Iwd1F6d2bDmeXGHCug4t031YTpRfh344pwnFt0pMmDfF_g1guDosI4q9mnQoWV2c1k8YkEOzv4X8hsBR0G4nCrTR81u2WtUvu3XmFd/s320/art-features_display_main-620x349.jpg" style="margin-left: auto; margin-right: auto;" width="320" /></td></tr><tr><td class="tr-caption" style="text-align: center;"><i><span style="font-family: Trebuchet MS, sans-serif;">iSight webcams</span></i></td></tr></tbody></table><div style="border: 0px; line-height: 17px; padding: 0px; vertical-align: baseline;"><span style="font-family: Verdana, sans-serif;">Fortunately, the FBI was able to identify a suspect: her high school classmate, a man named Jared Abrahams. The FBI says it found software on Abrahams's computer that allowed him to spy remotely on her and numerous other women.</span></div><span style="border: 0px; line-height: 17px; margin: 0px; padding: 0px; vertical-align: baseline;"><span style="font-family: Verdana, sans-serif;"><br /></span></span><div style="border: 0px; line-height: 17px; padding: 0px; vertical-align: baseline;"><span style="font-family: Verdana, sans-serif;">Abrahams pleaded guilty to extortion in October. The woman, identified in court papers only as C.W., later identified herself on Twitter as Miss Teen USA Cassidy Wolf. While her case was instant fodder for celebrity gossip sites, it left a serious issue unresolved:</span></div><div class="hidden" id="adspot-300x250-pos-3" style="border: 0px; left: -9000px; line-height: 17px; margin: 0px; padding: 0px; position: absolute; top: 0px; vertical-align: baseline; width: 90px;"><small style="border: 0px; font-style: inherit; font-weight: inherit; margin: 0px; padding: 0px; vertical-align: baseline;"><span style="font-family: Verdana, sans-serif; font-size: small;">Advertisement</span></small></div><div style="border: 0px; line-height: 17px; padding: 0px; vertical-align: baseline;"><span style="font-family: Verdana, sans-serif;">Most laptops with built-in cameras have an important privacy feature – a light that is supposed to turn on any time the camera is in use. But Wolf said she never saw the light on her laptop. As a result, she had no idea she was under surveillance.</span></div><div style="border: 0px; line-height: 17px; padding: 0px; vertical-align: baseline;"><span style="font-family: Verdana, sans-serif;">That wasn't supposed to be possible. While controlling a laptop camera remotely has long been a source of concern to privacy advocates, conventional wisdom said there was no way to deactivate the warning light.</span></div><span style="border: 0px; line-height: 17px; margin: 0px; padding: 0px; vertical-align: baseline;"><span style="font-family: Verdana, sans-serif;"><br /></span></span><div style="border: 0px; line-height: 17px; padding: 0px; vertical-align: baseline;"><span style="font-family: Verdana, sans-serif;">Now research from Johns Hopkins University provides the first public confirmation that it's possible to do just that, and demonstrates how. While the research focused on MacBook and iMac models released before 2008, the authors say similar techniques would probably work on more recent computers from a wide variety of vendors.</span></div><div style="border: 0px; line-height: 17px; padding: 0px; vertical-align: baseline;"><span style="font-family: Verdana, sans-serif;">In other words, if a laptop has a built-in camera, it's possible someone – whether the federal government or a malicious 19-year-old – could access it to spy on the user at any time, and the user would never know.</span></div><div style="border: 0px; line-height: 17px; padding: 0px; vertical-align: baseline;"><span style="font-family: Verdana, sans-serif;">The iSight camera was designed to prevent this, said Stephen Checkoway, a computer science professor at Johns Hopkins and a co-author of the study. "Apple went to some amount of effort to make sure that the LED would turn on whenever the camera was taking images," Checkoway said. The 2008-era Apple products they studied had a "hardware interlock" between the camera and the light to ensure the camera couldn't turn on without alerting its owner.</span></div><div style="border: 0px; line-height: 17px; padding: 0px; vertical-align: baseline;"><span style="font-family: Verdana, sans-serif;">But Checkoway and his co-author, Johns Hopkins University graduate student Matthew Brocker, were able to get around this security feature. That's because a modern laptop is actually several different computers in one package. "There's more than one chip on your computer," said Charlie Miller, a security expert at Twitter. "There's a chip in the battery, a chip in the keyboard, a chip in the camera."</span></div><div style="border: 0px; line-height: 17px; padding: 0px; vertical-align: baseline;"><span style="font-family: Verdana, sans-serif;">MacBooks are designed to prevent software running on the MacBook's central processing unit (CPU) from activating the iSight camera without turning on the light. But researchers figured out how to reprogram the chip inside the camera, known as a micro-controller, to defeat this feature.</span></div><div style="border: 0px; line-height: 17px; padding: 0px; vertical-align: baseline;"><span style="font-family: Verdana, sans-serif;">In a paper called "iSeeYou: Disabling the MacBook Webcam Indicator LED", Brocker and Checkoway describe how to reprogram the iSight camera's micro-controller to allow the camera to be turned on while the light stays off. Their research is under consideration for an upcoming academic security conference.</span></div><div style="border: 0px; line-height: 17px; padding: 0px; vertical-align: baseline;"><span style="font-family: Verdana, sans-serif;">Attacks that exploit microcontrollers are becoming more common. "People are starting to think about what happens when you can reprogram each of those," Miller said. For example, he demonstrated an attack last year on the software that controls Apple batteries, which causes the battery to discharge rapidly, potentially leading to a fire or explosion. Another researcher was able to convert the built-in Apple keyboard into spyware using a similar method.</span></div><div style="border: 0px; line-height: 17px; padding: 0px; vertical-align: baseline;"><span style="font-family: Verdana, sans-serif;">According to the researchers, the vulnerability they discovered affects "Apple internal iSight webcams found in earlier-generation Apple products, including the iMac G5 and early Intel-based iMacs, MacBooks and MacBook Pros until roughly 2008." While the attack outlined in the paper is limited to those devices, researchers like Charlie Miller suggest that the attack could be applicable to newer systems as well.</span></div><div style="border: 0px; line-height: 17px; padding: 0px; vertical-align: baseline;"><span style="font-family: Verdana, sans-serif;">"There's no reason you can't do it – it's just a lot of work and resources, but it depends on how well [Apple] secured the hardware," Miller said.</span></div><div style="border: 0px; line-height: 17px; padding: 0px; vertical-align: baseline;"><span style="font-family: Verdana, sans-serif;">Apple did not reply to requests for comment for this article. Brocker and Checkoway write in their report that they contacted the company on July 16. "Apple employees followed up several times but did not inform us of any possible mitigation plans," the researchers wrote.</span></div><div style="border: 0px; line-height: 17px; padding: 0px; vertical-align: baseline;"><span style="font-family: Verdana, sans-serif;">The software used by Abrahams in the Wolf case is known as a Remote Administration Tool, or RAT. This software, which allows someone to control a computer from across the internet, has legitimate uses. For example, it can make it easier for a school's IT staff to administer a classroom full of computers.</span></div><div style="border: 0px; line-height: 17px; padding: 0px; vertical-align: baseline;"><span style="font-family: Verdana, sans-serif;">Indeed, the devices the researchers studied were similar to MacBooks involved in a notorious case in Pennsylvania in 2008. Administrators at Lower Merion High School outside Philadelphia reportedly captured 56,000 images of students using the RAT installed on school-issued laptops. Students reported seeing a "creepy" green flicker that indicated that the camera was in use. That eventually led to a lawsuit.</span></div><div style="border: 0px; line-height: 17px; padding: 0px; vertical-align: baseline;"><span style="font-family: Verdana, sans-serif;">But more sophisticated remote monitoring tools may already be able to suppress the warning light, said Morgan Marquis-Boire, a security researcher at the University of Toronto.</span></div><div style="border: 0px; line-height: 17px; padding: 0px; vertical-align: baseline;"><span style="font-family: Verdana, sans-serif;">He points to commercial surveillance products such as Hacking Team and FinFisher that are marketed for use by governments. FinFisher is a suite of tools sold by a European firm called the Gamma Group. A company marketing document released by Wikileaks indicated that Finfisher could be "covertly deployed on the Target Systems" and enable, among other things, "Live Surveillance through Webcam and Microphone."</span></div><div style="border: 0px; line-height: 17px; padding: 0px; vertical-align: baseline;"><span style="font-family: Verdana, sans-serif;">The Chinese government has also been accused of using RATs for surveillance purposes. A 2009 report from the University of Toronto described a surveillance program called Ghostnet that the Chinese government allegedly used to spy on prominent Tibetans, including the Dalai Llama. The authors reported that "web cameras are being silently triggered, and audio inputs surreptitiously activated," though it's not clear whether the Ghostnet software is capable of disabling camera warning lights.</span></div><div style="border: 0px; line-height: 17px; padding: 0px; vertical-align: baseline;"><span style="font-family: Verdana, sans-serif;">But there is an easy way for users to protect themselves. Many security experts have used sticky tape, with the latest research perhaps proving why they shouldn't be considered paranoid.</span></div><div style="border: 0px; line-height: 17px; padding: 0px; vertical-align: baseline;"><span style="font-family: Verdana, sans-serif;">"The safest thing to do is to put a piece of tape on your camera," Miller said.</span></div><br />

Activate Apple iSight webcams without warning light

he woman was shocked when she received two nude photos of herself by email. The photos had been taken over a period of several months – with...

Read more »

What a successful exploit of a Linux server looks like

<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody><tr><td style="text-align: center;"><img border="0" height="290" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg0XwHAgeMdc7PwC5-Ve_YSjb5goY1YrcNoxum5AnKazh7I_xRqtFE1fV-1z39Rr3nTrQLa-HCSyuda2EuLIs5BHuc3ENK-aLNQitEsSjizl5JVA4tBfvj-RrGZdoBRGLM5uKwqXYIYo22y/s640/irc_1-640x291.jpg" style="margin-left: auto; margin-right: auto;" width="640" /></td></tr><tr><td class="tr-caption" style="text-align: center;"><i><span style="font-family: Trebuchet MS, sans-serif;">Exploit of a Linux</span></i></td></tr></tbody></table><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg0XwHAgeMdc7PwC5-Ve_YSjb5goY1YrcNoxum5AnKazh7I_xRqtFE1fV-1z39Rr3nTrQLa-HCSyuda2EuLIs5BHuc3ENK-aLNQitEsSjizl5JVA4tBfvj-RrGZdoBRGLM5uKwqXYIYo22y/s1600/irc_1-640x291.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><span style="color: black; font-family: Verdana, sans-serif;"></span></a></div><div style="background-color: white; line-height: 20px; margin-bottom: 15px;"><span style="font-family: Verdana, sans-serif;">A security researcher with George Washington University, DiMino noticed several IP addresses attempting to hijack the Linux server by exploiting a <a href="http://www.kb.cert.org/vuls/id/520827" style="text-decoration: none;">now-patched PHP flaw</a> that gave attackers the ability to remotely execute commands on vulnerable machines. DiMino was curious to know what the people behind the attacks intended to do with his machine, so he set up a "honeypot" box that, for research purposes, ran an older version of the Web development language.</span></div><div style="background-color: white; line-height: 20px; margin-bottom: 15px;"><span style="font-family: Verdana, sans-serif;">The attackers' HTTP POST request contained a variety of commands that in short order downloaded a Perl script that was disguised as a PDF document file, executed it, and then deleted it. To ensure success, the attackers repeated the steps using curl, fetch, lwp-get requests. The Perl script was programmed to sleep for periods of time, presumably to prevent administrators from noticing anything amiss. Eventually, the compromised machine connected to an Internet relay chat channel, where it downloaded another script and executed it. Then he ran forensic software and snapped lots of screen shots so everyone could follow along.</span></div><div style="background-color: white; line-height: 20px; margin-bottom: 15px;"><span style="font-family: Verdana, sans-serif;">In short order, the machine was running a host of apps installed by the attackers. Some of them hijacked the server hardware to perform the mathematical operations required to "mine" Bitcoins and another digital currency known as <a href="https://github.com/primecoin/primecoin/wiki" style="text-decoration: none;">Primecoin</a>. The server was also equipped with apps to perform denial-of-service attacks on other machines and to scan other machines for known vulnerabilities and exploit them when found.</span></div><div style="background-color: white; line-height: 20px; margin-bottom: 15px;"><span style="font-family: Verdana, sans-serif;">"Across my honeypots, I'll see dozens of these a day, including Linux ELF [executable and linkable format] files, perlbots, and vintage shells," DiMino wrote in a <a href="http://sempersecurus.blogspot.com/2013/12/a-forensic-overview-of-linux-perlbot.html" style="text-decoration: none;">blog post published Tuesday</a>. "While these injected perl and shell scripts are typically considered the patio gnats of the Internet, more annoying than anything else, they do have the potential to cause considerable harm."</span></div><h2 style="-webkit-font-smoothing: antialiased; background-color: white; line-height: 24px; list-style: none; margin: 0px 0px 15px; padding: 0px; text-rendering: optimizelegibility;"><span style="font-family: Verdana, sans-serif; font-size: small;">Not just for Windows anymore</span></h2><div style="background-color: white; line-height: 20px; margin-bottom: 15px;"><span style="font-family: Verdana, sans-serif;">DiMino's anatomy lesson is a graphic demonstration of recent advances in exploits for Linux. Once primarily the domain of machines running Windows, point-and-click exploits are used to commandeer machines so attackers can use them in online crime schemes. The increased horsepower and bandwidth available in many Linux servers often makes them more attractive than personal computers running Microsoft OSes. And as has always been the case, hijacked bots don't come with expensive electricity bills, and they often make it easy for criminals to cover their tracks.</span></div><div style="background-color: white; line-height: 20px; margin-bottom: 15px;"><span style="font-family: Verdana, sans-serif;">The takeaway from the demonstration is just how important it is for admins working with any OS to stay on top of security patching. DiMino counsels admins to go a step further by learning how to actively monitor network activity on the machines they watch over. His blog post provides instructions for using the <a href="https://code.google.com/p/volatility/" style="text-decoration: none;">Volatility software framework</a> to perform forensics on server memory. Among other things, it allows users to identify remote connections and the processes that initiate them.</span></div><div style="background-color: white; line-height: 20px; margin-bottom: 15px;"><i><span style="font-family: Verdana, sans-serif;">Via : <a href="http://arstechnica.com/security/2013/12/anatomy-of-a-hack-what-a-successful-exploit-of-a-linux-server-looks-like/" target="_blank">Ars Technica</a></span></i></div>

What a successful exploit of a Linux server looks like

Exploit of a Linux A security researcher with George Washington University, DiMino noticed several IP addresses attempting to hijack the Lin...

Read more »

Hackers break into Washington Post servers

<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody><tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjCWnZh9ivMcQBdv2RM0yPpgfy9kLOHp5zeO1WJG9Gxyt9-Vizl8Zm2WTwXr2Abm7WQQI12JWTYini5HbsKe7MOrZXssrWjKmDZuZbRh31NqjUcM4a9ODBOjZSyK1VIPVyt3APcs5D77Jik/s1600/istock_000028187138small-100066105-large.jpg" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjCWnZh9ivMcQBdv2RM0yPpgfy9kLOHp5zeO1WJG9Gxyt9-Vizl8Zm2WTwXr2Abm7WQQI12JWTYini5HbsKe7MOrZXssrWjKmDZuZbRh31NqjUcM4a9ODBOjZSyK1VIPVyt3APcs5D77Jik/s1600/istock_000028187138small-100066105-large.jpg" /></a></td></tr><tr><td class="tr-caption" style="text-align: center;"><span style="background-color: white; font-family: Verdana, sans-serif; font-size: small; line-height: 20px; text-align: start;"><i>Security</i></span></td></tr></tbody></table><div style="background-color: white; line-height: 20px; margin-bottom: 15px;"><span style="font-family: Verdana, sans-serif;"><em><br /></em></span></div><div style="background-color: white; line-height: 20px; margin-bottom: 15px;"><span style="font-family: Verdana, sans-serif;"><em>The Washington Post</em>'s servers were penetrated by hackers who accessed employees' user names and password data in a breach that marked the third intrusion in as many years, the paper reported.</span></div><div style="background-color: white; line-height: 20px; margin-bottom: 15px;"><span style="font-family: Verdana, sans-serif;">Security personnel still don't know the full extent of the loss, an <a href="http://www.washingtonpost.com/business/technology/hackers-break-into-washington-post-servers/2013/12/18/dff8c362-682c-11e3-8b5b-a77187b716a3_story.html" style="text-decoration: none;">article published Wednesday</a> said. The intrusion was discovered by outside security consultant Mandiant, which reported it to<em>Washington Post</em> officials Wednesday. Compromised data includes employees' user names and passwords that were "stored in encrypted form," which typically means as a cryptographic hash. <em>Post</em>officials, working under the assumption that a fair percentage of hashed passwords can be cracked, planned to direct all employees to change their passwords.</span></div><div style="background-color: white; line-height: 20px; margin-bottom: 15px;"><span style="font-family: Verdana, sans-serif;">There's no evidence yet that subscriber information such as credit card data or home addresses was accessed. There was also no immediate sign that hackers had accessed the paper's publishing system, employee e-mail databases, or sensitive personal information  belonging to workers. Wednesday's article cited a <em>Washington Post</em> official as saying investigators believe the intrusion lasted at most a few days.</span></div><div style="background-color: white; line-height: 20px; margin-bottom: 15px;"><span style="font-family: Verdana, sans-serif;">Large international news organizations have become a common hacking target in recent years. Early this year, the<em> New York Times</em> said China-based attackers persistently intruded on its internal serversfor four months straight. In the process, they obtained password data for all of its reporters and other employees. The<em> Wall Street Journal </em>suffered its own intrusion around the same time. And in February, KrebsonSecurity reporter Brian Krebs uncovered an attack on <em>Washington Post</em> systems, also by suspected hackers from China. The <em>NYT</em>, <em>Washington Post</em>, Associated Press, and other news organizations have also been successfully targeted in other hacks, including a string of them by a group calling itself the Syrian Electronic Army.</span></div><div style="background-color: white; line-height: 20px; margin-bottom: 15px;"><span style="font-family: Verdana, sans-serif;">Source : <a href="http://arstechnica.com/security/2013/12/hackers-break-into-washington-post-servers-for-third-time-in-three-years/" target="_blank">Ars Technica</a></span></div>

Hackers break into Washington Post servers

Security The Washington Post 's servers were penetrated by hackers who accessed employees' user names and password data in a breach ...

Read more »

Macbook webcams CAN spy on you

<table cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody><tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEing7TXnkw0RuMYIPW17lD3p6lgYgB1zFZ21QwGGg5NPlPIzbDWsVg1juT-TL3xD_bfYJmah9Fs4gp8htgMwbGfWmw8QQyLaW_vJ5NVupahP3ov6FH3NZru9XM5GikvP_VhTZXabs1yG6r3/s1600/ifixit.jpg" imageanchor="1" style="margin-left: auto; margin-right: auto;"><span style="color: black; font-family: Verdana, sans-serif;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEing7TXnkw0RuMYIPW17lD3p6lgYgB1zFZ21QwGGg5NPlPIzbDWsVg1juT-TL3xD_bfYJmah9Fs4gp8htgMwbGfWmw8QQyLaW_vJ5NVupahP3ov6FH3NZru9XM5GikvP_VhTZXabs1yG6r3/s1600/ifixit.jpg" /></span></a></td></tr><tr><td class="tr-caption" style="text-align: center;"><span style="font-family: Verdana, sans-serif; font-size: small;"><i>Macbook<br /><br /><br /></i><span style="background-color: white; line-height: 21px; text-align: start;">Apple computers have a “hardware interlock” between the camera and the light that is supposed to ensure the camera can't be activated without alerting the user by lighting a tell-tale LED above the screen.</span></span><div style="background-color: white; line-height: 21px; text-align: start;"><span style="font-family: Verdana, sans-serif; font-size: small;">However Stephen Checkoway, a computer science professor at Johns Hopkins University and graduate student Matthew Brocker were able to circumvent this security feature by reprogramming the micro-controller chip inside the camera.</span></div><div style="background-color: white; line-height: 21px; text-align: start;"><span style="font-family: Verdana, sans-serif; font-size: small;">Normally, any program running on a MacBook’s central processing unit that takes images through Apple's iSight camera would turn on the tell-tale light. Brocker and Checkoway's reprogramming tactic allows the camera and it light to be activated independently, so that the camera can be running while the light is switched off.</span></div><div style="background-color: white; line-height: 21px; text-align: start;"><span style="font-family: Verdana, sans-serif; font-size: small;">The researchers have released proof-of-concept software to demonstrate the trick, including a <a href="https://jscholarship.library.jhu.edu/handle/1774.2/36569" style="text-decoration: none;" target="_blank">paper</a> , entitled <em>iSeeYou: Disabling the MacBook Webcam Indicator LED</em>. The study provides the first public confirmation that a sophisticated hacker tactic long suspected to be part of the playbook of intelligence agencies, feds and others is not only possible but relatively straightforward.</span></div><blockquote style="background-color: white; font-weight: bold; line-height: 21px; margin: 0.5em 1em; padding: 0px; text-align: start;"><span style="font-family: Verdana, sans-serif; font-size: small;">The same technique that allows us to disable the LED, namely reprogramming the firmware that runs on the iSight, enables a virtual machine escape whereby malware running inside a virtual machine reprograms the camera to act as a USB Human Interface Device (HID) keyboard which executes code in the host operating system. We build two proofs-of-concept: (1) an OS X application, iSeeYou, which demonstrates capturing video with the LED disabled; and (2) a virtual machine escape that launches Terminal.app and runs shell commands. To defend against these and related threats, we build an OS X kernel extension, iSightDefender, which prohibits the modification of the iSight’s firmware from user space.</span></blockquote><div style="text-align: justify;"><span style="font-family: Verdana, sans-serif; font-size: small;">Source : <a href="http://www.theregister.co.uk/2013/12/19/apple_isight_webcam_led_hack/" target="_blank">The Register </a></span></div></td></tr></tbody></table><div style="text-align: justify;"><br /></div>

Macbook webcams CAN spy on you

Macbook Apple computers have a “hardware interlock” between the camera and the light that is supposed to ensure the camera can't be acti...

Read more »

Vendor security patches lag dangerously, study suggests

<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody><tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjYEaXJjOlr1FmTg4gHYvN5J07I6cU94GYR_ALStCn6Ar-ySVADcDAFlC_28aBNiGwSHdIL4AOgwfdXipemNjaoehza-HheUxXOyNRkznHzEV_w-qVGKQmz07622z-R50uJBfhyChdgIaM/s1600/browser_security-100051258-gallery.jpg" imageanchor="1" style="margin-left: auto; margin-right: auto;"><span style="font-family: Verdana, sans-serif;"><img border="0" height="214" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjYEaXJjOlr1FmTg4gHYvN5J07I6cU94GYR_ALStCn6Ar-ySVADcDAFlC_28aBNiGwSHdIL4AOgwfdXipemNjaoehza-HheUxXOyNRkznHzEV_w-qVGKQmz07622z-R50uJBfhyChdgIaM/s320/browser_security-100051258-gallery.jpg" width="320" /></span></a></td></tr><tr><td class="tr-caption" style="text-align: center;"><i><span style="font-family: Verdana, sans-serif;">Vendor security patches lag dangerously</span></i></td></tr></tbody></table><div style="background-color: white; box-sizing: border-box; color: #222222; font-size: 15px; line-height: 1.7em; margin-bottom: 0.7em;"><span style="font-family: Verdana, sans-serif;">Subscribers to organizations that sell exploits for vulnerabilities not yet known to software developers gain daily access to scores of flaws in the world’s most popular technology, a study shows.</span></div><div style="background-color: white; box-sizing: border-box; color: #222222; font-size: 15px; line-height: 1.7em; margin-bottom: 0.7em;"><span style="font-family: Verdana, sans-serif;">NSS Labs, which is in the business of testing security products for corporate subscribers, found that over the last three years, subscribers of two major vulnerability programs had access on any given day to at least 58 exploitable flaws in Microsoft, Apple, Oracle, or Adobe products.</span></div><div style="background-color: white; box-sizing: border-box; color: #222222; font-size: 15px; line-height: 1.7em; margin-bottom: 0.7em;"><span style="font-family: Verdana, sans-serif;">In addition, NSS labs found that an average of 151 days passed from the time when the programs purchased a vulnerability from a researcher and the affected vendor released a patch.</span></div><h2 style="background-color: white; box-sizing: border-box; color: #222222; margin-bottom: 0.25em; margin-top: 1em;"><span style="font-family: Verdana, sans-serif;">Some vendors buy in</span></h2><div style="background-color: white; box-sizing: border-box; color: #222222; font-size: 15px; line-height: 1.7em; margin-bottom: 0.7em;"><span style="font-family: Verdana, sans-serif;">The findings, released earlier this month, were based on an analysis of ten years of data from TippingPoint, a network security maker Hewlett-Packard acquired in 2010, and iDefense, a security intelligence service owned by VeriSign. Both organizations buy vulnerabilities, inform subscribers, and work with vendors in producing patches.</span></div><div style="background-color: white; box-sizing: border-box; color: #222222; font-size: 15px; line-height: 1.7em; margin-bottom: 0.7em;"><span style="font-family: Verdana, sans-serif;">Stefan Frei, NSS research director and author of the report, said the actual number of secret vulnerabilities available to cybercriminals, government agencies and corporations is much larger, because of the amount of money they are willing to pay.</span></div><div style="background-color: white; box-sizing: border-box; color: #222222; font-size: 15px; line-height: 1.7em; margin-bottom: 0.7em;"><span style="font-family: Verdana, sans-serif;">Cybercriminals will buy so-called zero-day vulnerabilities in the black market, while government agencies and corporations purchase them from brokers and exploit clearinghouses, such as VUPEN Security, ReVuln, Endgame Systems, Exodus Intelligence, and Netragard.</span></div><div style="background-color: white; box-sizing: border-box; color: #222222; font-size: 15px; line-height: 1.7em; margin-bottom: 0.7em;"><span style="font-family: Verdana, sans-serif;">The six vendors collectively can provide at least 100 exploits per year to subscribers, Frei said. According to a February 2010 price list, Endgame sold 25 zero-day exploits a year for $2.5 million.</span></div><div style="background-color: white; box-sizing: border-box; color: #222222; font-size: 15px; line-height: 1.7em; margin-bottom: 0.7em;"><span style="font-family: Verdana, sans-serif;">In July, Netragard founder Adriel Desautels told The New York Times that the average vulnerability sells from around $35,000 to $160,000.</span></div><h2 style="background-color: white; box-sizing: border-box; color: #222222; margin-bottom: 0.25em; margin-top: 1em;"><span style="font-family: Verdana, sans-serif;">Security: A moving target</span></h2><div style="background-color: white; box-sizing: border-box; color: #222222; font-size: 15px; line-height: 1.7em; margin-bottom: 0.7em;"><span style="font-family: Verdana, sans-serif;">Part of the reason vulnerabilities are always present is because of developer errors and also because software makers are in the business of selling product, experts say. The latter means meeting deadlines for shipping software often trumps spending additional time and money on security.</span></div><div style="background-color: white; box-sizing: border-box; color: #222222; font-size: 15px; line-height: 1.7em; margin-bottom: 0.7em;"><span style="font-family: Verdana, sans-serif;">Because of the number of vulnerabilities bought and sold, companies that believe their intellectual property makes them prime targets for well-financed hackers should assume their computer systems have already been breached, Frei said.</span></div><div style="background-color: white; box-sizing: border-box; color: #222222; font-size: 15px; line-height: 1.7em; margin-bottom: 0.7em;"><span style="font-family: Verdana, sans-serif;">”One hundred percent prevention is not possible,” he said.</span></div><div style="background-color: white; box-sizing: border-box; color: #222222; font-size: 15px; line-height: 1.7em; margin-bottom: 0.7em;"><span style="font-family: Verdana, sans-serif;">Therefore, companies need to have the experts and security tools in place to detect compromises, Frei said. Once a breach is discovered, then there should be a well-defined plan in place for dealing with it.</span></div><div style="background-color: white; box-sizing: border-box; color: #222222; font-size: 15px; line-height: 1.7em; margin-bottom: 0.7em;"><span style="font-family: Verdana, sans-serif;">That plan should include gathering forensic evidence to determine how the breach occurred. In addition, all software on the infected systems should be removed and reinstalled. Steps taken following a breach should be reviewed regularly to make sure they are up to date.</span></div><div style="background-color: white; box-sizing: border-box; color: #222222; font-size: 15px; line-height: 1.7em; margin-bottom: 0.7em;"><i><span style="font-family: Verdana, sans-serif;">Via: <a href="http://www.pcworld.com/article/2070662/vendor-security-patches-lag-dangerously-study-suggests.html">PCWorld</a></span></i></div>

Vendor security patches lag dangerously, study suggests

Vendor security patches lag dangerously Subscribers to organizations that sell exploits for vulnerabilities not yet known to software develo...

Read more »

Canadian government Google for 'anti-competitive acts'

<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgsJSdAiCAurs-VqDgAUWr_v8nFPYWvIQ0o-VdF8VnH9YPbWle1s9K4oL-xtQl40hzAn_SdeXFMjAmz7yJUqOXPSyGfNmHpbWwtzImZ2kOLm90Zl9OelsGm44hkXUye6CJiH2amD0pcH-Fz/s1600/google.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><span style="font-family: Verdana, sans-serif;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgsJSdAiCAurs-VqDgAUWr_v8nFPYWvIQ0o-VdF8VnH9YPbWle1s9K4oL-xtQl40hzAn_SdeXFMjAmz7yJUqOXPSyGfNmHpbWwtzImZ2kOLm90Zl9OelsGm44hkXUye6CJiH2amD0pcH-Fz/s1600/google.JPG" /></span></a></div><span style="font-family: Verdana, sans-serif;">Google may be in hot water with the Canadian Competition Bureau. The bureau announced it would be investigating the company in May, but more recent reports suggest it's not too happy with what the investigation has turned up.</span><br /><span style="font-family: Verdana, sans-serif;"><br /></span><span style="font-family: Verdana, sans-serif;">Documents filed to the Federal Court of Canada describe Google as controlling at least one market related to search and advertising, potentially raising anti-trust concerns. The documents also suggest Google may have engaged in a number of anti-competitive acts by manipulating search results to favor their own products, or preventing data export from the company's AdWords platform. If the acts are found to be anti-competitive, it would mean a violation of Canadian anti-trust laws, and potentially grave consequences for the search giant.</span><br /><span style="font-family: Verdana, sans-serif;"><br /></span><span style="font-family: Verdana, sans-serif;">This isn't the first time Google has faced regulatory scrutiny over its ad and search practices. In January of 2013, the company reached a settlement over similar claims by the US's Federal Trade Commission, which resulted in minor shifts in company practices. Those shifts were enough to halt ongoing suits in the international trade commission, although competitors like Yelp called the settlement "a missed opportunity." Judging by today's news, it seems as if Canada may not be satisfied either.</span><br /><i><span style="font-family: Verdana, sans-serif;">Source : <a href="http://business.financialpost.com/2013/12/13/google-inc-abusive-competition-bureau/?__lsa=77bb-a18f">Financial Post</a></span></i><br /><i><span style="font-family: Verdana, sans-serif;">Via : <a href="http://www.theverge.com/2013/12/15/5210582/canadian-government-investigates-google-for-anti-competitive-acts">The Verge</a></span></i>

Canadian government Google for 'anti-competitive acts'

Google may be in hot water with the Canadian Competition Bureau. The bureau announced it would be investigating the company in May, but more...

Read more »

NSA can listen in on encrypted phone calls

<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody><tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhKTFCvTtcv19Z6qWZHEoJEE7exWN_goz_S9ORYInSRn9JCUGpRXbp6zHJCthNswxw7lo7cls6r5LZUUm9G6QCaHTJq1kzxuM5K0eo3V-UoQL972ZxHmU-OLYtjMH2XBM6DqvxI8wGUDEJ0/s1600/2D9988203-8C9004011-2013-09-15t130919z_1_cbre98e10jr00_rtroptp_3_cloud-europe-spying.blocks_desktop_medium.jpg" imageanchor="1" style="margin-left: auto; margin-right: auto;"><span style="color: black; font-family: Verdana, sans-serif;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhKTFCvTtcv19Z6qWZHEoJEE7exWN_goz_S9ORYInSRn9JCUGpRXbp6zHJCthNswxw7lo7cls6r5LZUUm9G6QCaHTJq1kzxuM5K0eo3V-UoQL972ZxHmU-OLYtjMH2XBM6DqvxI8wGUDEJ0/s1600/2D9988203-8C9004011-2013-09-15t130919z_1_cbre98e10jr00_rtroptp_3_cloud-europe-spying.blocks_desktop_medium.jpg" /></span></a></td></tr><tr><td class="tr-caption" style="text-align: center;"><span style="line-height: 12.5px; text-align: right;"><i><span style="font-family: Verdana, sans-serif; font-size: small;">Pawel Kopczynski / Reuters</span></i></span></td></tr></tbody></table><div style="line-height: 1.5em; padding-right: 45px;"><span style="font-family: Verdana, sans-serif;">The latest documents from the National Security Agency leaked by Edward Snowden show that government spies are capable of listening in on mobile phone calls that use a common form of encryption, according to a <a href="http://www.washingtonpost.com/business/technology/by-cracking-cellphone-code-nsa-has-capacity-for-decoding-private-conversations/2013/12/13/e119b598-612f-11e3-bf45-61f69f54fc5f_story.html" style="-webkit-transition: all 0.1s ease-in-out; font-weight: 600; text-decoration: none; transition: all 0.1s ease-in-out;" target="_blank">Washington Post report</a>. But if you're vulnerable, blame your carrier — this code has been cracked for years.</span></div><div style="line-height: 1.5em; padding-right: 45px;"><span style="font-family: Verdana, sans-serif;">The Post on Friday published confidential government documents provided by Snowden that show that the NSA can "process" cellular phone calls on GSM networks, even if they are encrypted. GSM, which stands for Global System for Mobile communications, is the world's most widely used cellphone technology — though several large networks, notably Verizon and Sprint, rely on an older network technology called CDMA.</span></div><div style="line-height: 1.5em; padding-right: 45px;"><span style="font-family: Verdana, sans-serif;">The report may sound scary, but there's a bit of explanation required that puts this in perspective.</span></div><div style="line-height: 1.5em; padding-right: 45px;"><span style="font-family: Verdana, sans-serif;">First, it's only calls and not data that can be eavesdropped on, in this way at least. Second, it's only calls that have been encrypted according to a common standard called A5/1 — which was developed in 1987. The vulnerability comes into play on 2G networks, which modern cellphones may resort to it when 3G or 4G networks are not available or too congested. </span></div><div style="line-height: 1.5em; padding-right: 45px;"><span style="font-family: Verdana, sans-serif;">It's not uncommon for <a href="http://www.nbcnews.com/technology/facebook-strengthen-security-old-school-crypto-technique-6C10476610" style="-webkit-transition: all 0.1s ease-in-out; font-weight: 600; text-decoration: none; transition: all 0.1s ease-in-out;" target="_blank">old cryptography methods</a> to be in use for decades, or become relevant after years of disuse. But A5/1 has remained in use despite several serious vulnerabilities being demonstrated by cryptographers. The methods are too technical to get into here, but a modern PC would have little trouble performing the attacks; a number of papers on the subject are stored at<a href="http://cryptome.org/0001/gsm-a5-files.htm" style="-webkit-transition: all 0.1s ease-in-out; font-weight: 600; text-decoration: none; transition: all 0.1s ease-in-out;" target="_blank">Cryptome</a>.</span></div><div style="line-height: 1.5em; padding-right: 45px;"><span style="font-family: Verdana, sans-serif;">Why are carriers and phone manufacturers around the world using such an out-of-date cypher? It's not clear, but some carriers are already making the change to the newer A5/3 method of encryption.</span></div><div style="line-height: 1.5em; padding-right: 45px;"><span style="font-family: Verdana, sans-serif;">One other thing to consider is that these conversations, however strong their encryption, are automatically decoded upon reaching the carrier's internal network. So even if the NSA can't listen in between a target and the tower, they could bring a judge-signed order to the carrier and not have to decrypt anything at all.</span></div><div style="line-height: 1.5em; padding-right: 45px;"><span style="font-family: Verdana, sans-serif;">Lastly, the NSA has repeatedly stated that it only snoops on conversations involving foreign citizens, as it has no legal basis by which to conduct such surveillance on Americans. But if they can crack A5/1, others can as well — for everyone from hackers to foreign intelligence services, the cat's been out of the bag for a long time.</span></div><div style="line-height: 1.5em; padding-right: 45px;"><i><span style="font-family: Verdana, sans-serif;">Source : <a href="http://www.nbcnews.com/technology/nsa-can-listen-encrypted-phone-calls-theyre-not-only-ones-2D11744226">NBC News</a></span></i></div>

NSA can listen in on encrypted phone calls

Pawel Kopczynski / Reuters The latest documents from the National Security Agency leaked by Edward Snowden show that government spies are ca...

Read more »

PayPal cyberattack : Anonymous hackers plead guilty to 2010

<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody><tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiehYJfR6F3OP4jbKZ1KBQZMb_U2c-3dyYsgVgxZfsVd6I7z6P6vtNqInt6gqn_Eb-FJQJN9N2YTMT_4AZeYUf9d1AGQTXAemcjfdlToUhZ9Z4FrtzzBrBUdh4Nj93eZHkAQ9qlZM44SLuU/s1600/Anonymous.jpg" imageanchor="1" style="margin-left: auto; margin-right: auto;"><span style="color: black; font-family: Verdana, sans-serif;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiehYJfR6F3OP4jbKZ1KBQZMb_U2c-3dyYsgVgxZfsVd6I7z6P6vtNqInt6gqn_Eb-FJQJN9N2YTMT_4AZeYUf9d1AGQTXAemcjfdlToUhZ9Z4FrtzzBrBUdh4Nj93eZHkAQ9qlZM44SLuU/s1600/Anonymous.jpg" /></span></a></td></tr><tr><td class="tr-caption" style="text-align: center;"><i><span style="font-family: Verdana, sans-serif; font-size: small;">Anonymous hackers </span></i></td></tr></tbody></table><div style="-webkit-font-smoothing: subpixel-antialiased; background-color: white; border: 0px; line-height: 19.984375px; margin-top: 10px; outline: 0px; padding: 0px; vertical-align: baseline;"><span style="font-family: Verdana, sans-serif;">The hacktivist collective claimed responsibility for engineering the December 2010 distributed-denial-of-service attack in retaliation for the online payment processing company's suspension of an account linked to WikiLeaks after the document-leaking organization released a large number of classified documents.</span></div><div style="-webkit-font-smoothing: subpixel-antialiased; background-color: white; border: 0px; line-height: 19.984375px; margin-top: 10px; outline: 0px; padding: 0px; vertical-align: baseline;"><span style="font-family: Verdana, sans-serif;">"Citing violations of the PayPal terms of service, and in response to WikiLeaks' release of the classified cables, PayPal suspended WikiLeaks' accounts such that WikiLeaks could no longer receive donations via PayPal," US Attorney Melinda Haag in San Francisco said Friday in a <a href="http://www.justice.gov/usao/can/news/2013/2013_12_06_thirteen.guiltyplea.press.html" style="border: 0px; cursor: pointer; font-style: inherit; font-weight: inherit; margin: 0px; outline: none; padding: 0px; text-decoration: none; vertical-align: baseline;">statement</a>. "WikiLeaks' website declared that PayPal's action 'tried to economically strangle WikiLeaks.'"</span></div><div style="-webkit-font-smoothing: subpixel-antialiased; background-color: white; border: 0px; line-height: 19.984375px; margin-top: 10px; outline: 0px; padding: 0px; vertical-align: baseline;"><span style="font-family: Verdana, sans-serif;">Ten of the defendants pleaded guilty Thursday to one misdemeanor count of damaging a protected computer and one felony count of conspiracy, which they will be allowed to change to a misdemeanor at sentencing if they do not violate the terms of their plea agreement, according to the US attorney's statement. The remaining three pleaded guilty to one misdemeanor count each related to the attack, according to the statement.</span></div><div style="-webkit-font-smoothing: subpixel-antialiased; background-color: white; border: 0px; line-height: 19.984375px; margin-top: 10px; outline: 0px; padding: 0px; vertical-align: baseline;"><i><span style="font-family: Verdana, sans-serif;">Source : <a href="http://news.cnet.com/8301-1009_3-57614906-83/anonymous-hackers-plead-guilty-to-2010-paypal-cyberattack/">CNET</a></span></i></div>

PayPal cyberattack : Anonymous hackers plead guilty to 2010

Anonymous hackers  The hacktivist collective claimed responsibility for engineering the December 2010 distributed-denial-of-service attack i...

Read more »

Technology firms seek government surveillance reform

<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody><tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi4sFR5Ky97SOEoc74LjjotmKY8qpJufEbDmdu9TjiOisYB7naV108Bz9ycwSMh6hEqfDs_q4v62hCIj8LEJjE99WaRMSmG7eUh8nIG2kCD_bAnQ4UlRC7xfQRMXopjYq_2Jqc1bIxTVP7X/s1600/laptops.jpg" imageanchor="1" style="margin-left: auto; margin-right: auto;"><span style="color: black; font-family: Verdana, sans-serif;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi4sFR5Ky97SOEoc74LjjotmKY8qpJufEbDmdu9TjiOisYB7naV108Bz9ycwSMh6hEqfDs_q4v62hCIj8LEJjE99WaRMSmG7eUh8nIG2kCD_bAnQ4UlRC7xfQRMXopjYq_2Jqc1bIxTVP7X/s1600/laptops.jpg" /></span></a></td></tr><tr><td class="tr-caption" style="text-align: center;"><span style="background-color: white; line-height: 16px; text-align: start;"><i><span style="font-family: Verdana, sans-serif; font-size: small;">There have been concerns over surveillance programmes in the US</span></i></span></td></tr></tbody></table><div style="background-color: white; clear: left; line-height: 18px; margin-bottom: 18px; padding: 0px; text-rendering: auto;"><span style="font-family: Verdana, sans-serif;">Eight firms, Google, Apple, Facebook, Twitter, AOL, Microsoft, LinkedIn, and Yahoo, have formed an alliance called Reform Government Surveillance group.</span></div><div style="background-color: white; clear: left; line-height: 18px; margin-bottom: 18px; padding: 0px; text-rendering: auto;"><span style="font-family: Verdana, sans-serif;">The group has written a letter to the US President and Congress arguing that current surveillance practice "undermines the freedom" of people.</span></div><div style="background-color: white; clear: left; line-height: 18px; margin-bottom: 18px; padding: 0px; text-rendering: auto;"><span style="font-family: Verdana, sans-serif;">It comes after recent leaks detailed the extent of surveillance programmes.</span></div><div style="background-color: white; clear: left; line-height: 18px; margin-bottom: 18px; padding: 0px; text-rendering: auto;"><span style="font-family: Verdana, sans-serif;">"We understand that governments have a duty to protect their citizens. But this summer's revelations highlighted the urgent need to reform government surveillance practices worldwide," the group said in an open letter <a href="http://reformgovernmentsurveillance.com/" style="line-height: 16px; text-decoration: none;">published on its website</a>.</span></div><div style="background-color: white; clear: left; line-height: 18px; margin-bottom: 18px; padding: 0px; text-rendering: auto;"><span style="font-family: Verdana, sans-serif;">"The balance in many countries has tipped too far in favour of the state and away from the rights of the individual - rights that are enshrined in our Constitution.</span></div><div style="background-color: white; clear: left; line-height: 18px; margin-bottom: 18px; padding: 0px; text-rendering: auto;"><span style="font-family: Verdana, sans-serif;">"This undermines the freedoms we all cherish. It's time for a change," it added.</span></div><div style="background-color: white; clear: left; line-height: 18px; margin-bottom: 18px; padding: 0px; text-rendering: auto;"><span class="cross-head" style="display: block; line-height: 16px; margin: 0px 0px 16px; text-rendering: optimizelegibility;"><span style="font-family: Verdana, sans-serif;">Limited surveillance</span></span></div><div id="story_continues_2" style="background-color: white; clear: left; line-height: 18px; margin-bottom: 18px; padding: 0px; text-rendering: auto;"><span style="font-family: Verdana, sans-serif;">The move by the eight firms comes after whistle-blower Edward Snowden leaked information about surveillance carried out by the US government.</span></div><div style="background-color: white; clear: left; line-height: 18px; margin-bottom: 18px; padding: 0px; text-rendering: auto;"><span style="font-family: Verdana, sans-serif;">Mr Snowden, an ex-US intelligence contractor, leaked documents to the media highlighting the various methods used by agencies to gather information.</span></div><div style="background-color: white; clear: left; line-height: 18px; margin-bottom: 18px; padding: 0px; text-rendering: auto;"><span style="font-family: Verdana, sans-serif;">"Reports about government surveillance have shown there is a real need for greater disclosure and new limits on how governments collect information," said Mark Zuckerberg, chief executive of Facebook, the world's biggest social networking firm.</span></div><div style="background-color: white; clear: left; line-height: 18px; margin-bottom: 18px; padding: 0px; text-rendering: auto;"><span style="font-family: Verdana, sans-serif;">"The US government should take this opportunity to lead this reform effort and make things right."</span></div><div style="background-color: white; clear: left; line-height: 18px; margin-bottom: 18px; padding: 0px; text-rendering: auto;"><i><span style="font-family: Verdana, sans-serif;">Source : <a href="http://www.bbc.co.uk/news/technology-25297044">BBC News</a></span></i></div>

Technology firms seek government surveillance reform

There have been concerns over surveillance programmes in the US Eight firms, Google, Apple, Facebook, Twitter, AOL, Microsoft, LinkedIn, and...

Read more »

Microsoft Up Encryption After NSA Spying Reports

<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody><tr><td style="text-align: center;"><img border="0" height="400" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj8yNtEnTQ3Ab_NfOfc1ONgvCLkSbzFIPOivLBfXbS7_lxESJXTPMsTT0-jIpJxOxjmxUKYgtRcK7AE-AD_smTmlokYoKVdZiV9FaRQSf9yoXaogn2UdsM5qF87zJF0_hI7LuPscIKWhQho/s400/how-to-spy-on-people.jpg" style="margin-left: auto; margin-right: auto;" width="400" /></td></tr><tr><td class="tr-caption" style="text-align: center;"><span style="background-color: white; font-family: Verdana, sans-serif; font-size: small; line-height: 23px; text-align: start;"><i>NSA spying</i></span></td></tr></tbody></table><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj8yNtEnTQ3Ab_NfOfc1ONgvCLkSbzFIPOivLBfXbS7_lxESJXTPMsTT0-jIpJxOxjmxUKYgtRcK7AE-AD_smTmlokYoKVdZiV9FaRQSf9yoXaogn2UdsM5qF87zJF0_hI7LuPscIKWhQho/s1600/how-to-spy-on-people.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><span style="color: black; font-family: Verdana, sans-serif;"></span></a></div><div style="background-color: white; border: 0px; line-height: 23px; outline: 0px; padding: 0px 0px 9px; vertical-align: baseline;"><span style="font-family: Verdana, sans-serif;">If true, NSA spying could "seriously undermine confidence in the security and privacy of online communications," Microsoft's general counsel, Brad Smith, said in a <a data-ls-seen="1" href="http://blogs.technet.com/b/microsoft_blog/archive/2013/12/04/protecting-customer-data-from-government-snooping.aspx" style="border: 0px; font-style: inherit; font-weight: inherit; margin: 0px; outline: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;" target="_blank">blog post</a>. "In light of these allegations, we've decided to take immediate and coordinated action."</span></div><div style="background-color: white; border: 0px; line-height: 23px; outline: 0px; padding: 0px 0px 9px; vertical-align: baseline;"><span style="font-family: Verdana, sans-serif;">Smith pledged to "pursue a comprehensive engineering effort to strengthen the encryption of customer data across our networks and services." That includes major communications, productivity, and developer services such as Outlook.com, Office 365, SkyDrive, and Windows Azure.</span></div><div style="background-color: white; border: 0px; line-height: 23px; outline: 0px; padding: 0px 0px 9px; vertical-align: baseline;"><span style="font-family: Verdana, sans-serif;">Content moving between customers and Microsoft's servers will be encrypted by default, as will communications moving between Redmond's data centers, using "best-in-class industry cryptography to protect these channels, including Perfect Forward Secrecy and 2048-bit key lengths," Smith said. "All of this will be in place by the end of 2014, and much of it is effective immediately."</span></div><div style="background-color: white; border: 0px; line-height: 23px; outline: 0px; padding: 0px 0px 9px; vertical-align: baseline;"><span style="font-family: Verdana, sans-serif;">Smith said Office 365 and Outlook.com customer content is already encrypted when traveling between customers and Microsoft, while most Office 365 workloads as well as Windows Azure storage are now encrypted in transit between data centers.</span></div><div style="background-color: white; border: 0px; line-height: 23px; outline: 0px; padding: 0px 0px 9px; vertical-align: baseline;"><span style="font-family: Verdana, sans-serif;">In addition to encryption, Microsoft also said it will "take new steps to reinforce legal protections for our customers' data," - like informing them when the feds request data. "Where a gag order attempts to prohibit us from doing this, we will challenge it in court," Smith said.</span></div><div style="background-color: white; border: 0px; line-height: 23px; outline: 0px; padding: 0px 0px 9px; vertical-align: baseline;"><span style="font-family: Verdana, sans-serif;">The company will also open a "network of transparency centers" in Europe, the Americas and Asia that will build on "our long-standing program that provides government customers with an appropriate ability to review our source code, reassure themselves of its integrity, and confirm there are no back doors."</span></div><div style="background-color: white; border: 0px; line-height: 23px; outline: 0px; padding: 0px 0px 9px; vertical-align: baseline;"><span style="font-family: Verdana, sans-serif;">"Ultimately, we're sensitive to the balances that must be struck when it comes to technology, security and the law, ... but we also want to live in a country that is protected by the Constitution," Smith concluded. "We believe these new steps strike the right balance, advancing for all of us both the security we need and the privacy we deserve."</span></div><div style="background-color: white; border: 0px; line-height: 23px; outline: 0px; padding: 0px 0px 9px; vertical-align: baseline;"><span style="font-family: Verdana, sans-serif;">Reports that Microsoft would step up encryption <a class="" data-ls-seen="1" href="http://www.pcmag.com/article2/0,2817,2427747,00.asp" style="border: 0px; font-style: inherit; font-weight: inherit; margin: 0px; outline: 0px; padding: 0px; text-decoration: none; vertical-align: baseline;">emerged last month</a>. That came after The Washington Post, citing documents provided by Edward Snowden, reported on MUSCULAR, an NSA program that operates in conjunction with the U.K. version of the NSA, the Government Communications Headquarters (GCHQ). Together, they "are copying entire data flows across fiber-optic cables that carry information between the data centers of the Silicon Valley giants" like Yahoo and Google, the paper said.</span></div><div style="background-color: white; border: 0px; line-height: 23px; outline: 0px; padding: 0px 0px 9px; vertical-align: baseline;"><i><span style="font-family: Verdana, sans-serif;">Source :<a href="http://www.pcmag.com/article2/0,2817,2427962,00.asp"> PCMag</a></span></i></div>

Microsoft Up Encryption After NSA Spying Reports

NSA spying If true, NSA spying could "seriously undermine confidence in the security and privacy of online communications," Micros...

Read more »