Become a fan of Slashdot on Facebook

 



Forgot your password?
typodupeerror
×

Submission + - The Absurdly Underestimated Dangers of CSV Injection (georgemauer.net)

iONiUM writes: From the article:
"In some ways this is old news, but in other wayswell, I think few realize how absolutely devastating and omnipresent this vulnerability can be. It is an attack vector available in every application I’ve ever seen that takes user input and allows administrators to bulk export to CSV.

That is just about every application."

The article demonstrates 2 very easy ways to run code through CSV files, both within Excel and Google Sheets as well as illustrate a prevention technique:

"And just like that, the attacker has free reign to download a keylogger, install things, and overall remotely execute code not merely on any other person’s computer, but on that of someone guaranteed to have access to all user’s data; for example a manager or a company adminstrator. I wonder what other sort of files they might have lying around?"

Image

College To Save Money By Switching Email Font Screenshot-sm 306

The University of Wisconsin-Green Bay has come up with an unusual way of saving money: changing their email font. The school expects to use 30% less ink by switching from Arial to Century Gothic. From the article: "Diane Blohowiak is the school's director of computing. She says the new font uses about 30 percent less ink than the previous one. That could add up to real savings, since the cost of printer ink works out to about $10,000 per gallon. Blohowiak says the decision is part of the school's five-year plan to go green. She tells Wisconsin Public Radio it's great that a change that's eco-friendly also saves money."
Image

Disputed Island Disappears Into Sea Screenshot-sm 460

RawJoe writes "India and Bangladesh have argued for almost 30 years over control of a tiny island in the Bay of Bengal. Now rising sea levels have ended the argument for them: the island's gone. From the article: 'New Moore Island, in the Sunderbans, has been completely submerged, said oceanographer Sugata Hazra, a professor at Jadavpur University in Calcutta. Its disappearance has been confirmed by satellite imagery and sea patrols, he said. "What these two countries could not achieve from years of talking, has been resolved by global warming," said Hazra.'"
Handhelds

Apple Removes Wi-Fi Finders From App Store 461

jasonbrown writes "Apple on Thursday began removing another category of apps from its iPhone App Store. This time, it's not porn, it's Wi-Fi. Apple removed several Wi-Fi apps commonly referred to as stumblers, or apps that seek out available Wi-Fi networks near your location. According to a story on Cult of Mac, apps removed by Apple include WiFi-Where, WiFiFoFum, and yFy Network Finder."
Security

Windows 7 Users Warned Over Filename Security Risk 613

nandemoari writes "Would-be Windows 7 users have been warned to change a default setting which could leave them vulnerable to attack via bogus files. As a result, Microsoft is taking flak for failing to correct a problem found in previous editions of Windows. The issue involves the way Windows Explorer displays filenames. In all editions of Windows after Windows 98, the default setting hides the filename extension (which identifies what type of file it is). This means that a Word file titled 'partyinvite.doc' will show up in Windows Explorer as simply 'partyinvite'. The only exception to this rule is if Windows does not recognize the file type. The reason for this setting is that it makes for a less cluttered look and avoids filling the screen with redundant detail. However, a flaw in the way it works leaves it liable to exploitation by hackers. They can take an executable file (which can do much more damage to a computer when opened) and disguise it by calling it 'partyinvite.doc.exe.'"
Biotech

Hadrosaur Proteins Sequenced 81

jd writes "In a follow-up study to the one on proteins found in a T. Rex bone, the team responsible for the T. Rex study sequenced proteins found in an 80-million year old Hadrosaur fossil. According to the article, the proteins found confirm the results of the T. Rex study, proving that what was found in T. Rex was not a result of modern contamination, as had been claimed by skeptics, but was indeed the genuine thing: real dinosaur protein. Furthermore, despite the new fossil being 12 million years older, they claim they got more out — eight collagen peptides and 149 amino acids from four different samples. This, they say, places the Hadrosaur in the same family as T. Rex and Ostriches, but that not enough was recovered to say just how close or distant the relationship was."
Handhelds

Amazon Wins First Kindle Patent; Bigger Screen Expected Soon 50

An anonymous reader writes "One day before Amazon is scheduled to unveil its widescreen Kindle aimed at newspaper readers, the e-commerce giant has been awarded its first US patent for an e-book reader. The new patent, D591,741, is a design patent which protects the look and feel of the Kindle shell, not for fundamental technologies. Those patents are mostly held by E Ink Corp., which makes the 'liquidless paper' display. Sony, IBM, and the Discovery cable TV network also have e-book patents. Amazon, though the leading e-book seller, has none, but the patent award indicates they've applied for at least four recently." Also in Kindle news, PC World has a brief article up on the larger-screen Kindle DX (expected to launch Wednesday), including pictures first spotted on Engadget.
Printer

Soy-Based Toner Cartridges? 389

Jon.Laslow writes "I'm getting a lot of pressure from managers to switch to soy-based toner cartridges for our laser printers because they are 'greener.' The problem is, the only information I can find on them is from sales pitches; and the reviews all seem to be user testimonials. Do you have any experience soy-based printing products? Did you have any issues with them, and how was the print quality?"
Windows

Microsoft Not Ditching Vista Until At Least 2011 297

CWmike writes "Microsoft will not dump Vista when Windows 7 launches, and plans to keep selling it to computer makers, system builders, volume licensees and consumers at retail until at least January 2011, a Microsoft spokesman said, citing long-running policy. Earlier today, a Microsoft general manager hinted that the company might ditch Vista as soon as Windows 7 ships. He also said that support for all versions of Vista will end in April 2012. Neither is true, according to the company. Michael Cherry, an analyst with Directions on Microsoft, said, 'to try to stop Vista or make it unavailable, that would just draw attention... The truth is, few people will be likely to order it once Windows 7 is available.'"
Science

Nuclear Testing Helps Identify Fake Vintage Whiskey 366

Hugh Pickens writes "Industry experts claim the market for vintage whiskey has been flooded with fakes that purport to be several hundred years old but instead contain worthless spirit made just a few years ago. Now researchers at the Oxford Radiocarbon Accelerator Unit have developed a method that can pinpoint the date a whiskey was made by detecting traces of radioactive particles created by nuclear bomb tests in the 1950s. '"It is easy to tell if whiskey is fake as if it has been produced since the middle of the twentieth century, it has a very distinctive signature," says Dr. Tom Higham, deputy director of the facility. Nuclear bomb testing in the 1950s saw levels of carbon-14 in the atmosphere rise around the world so the amount of isotope absorbed by living organisms since this time has been artificially elevated. Whiskey extracted from antique bottles is sent to the laboratory where scientists burn the liquid and bombard the resulting gas with electrically charged particles so they can measure the carbon-14 in the sample. In one recent case, a bottle of 1856 Macallan Rare Reserve was withdrawn from auction at Christies, where it was expected to sell for up to £20,000, after the scientists found it had actually been produced in 1950. "So far there have probably been more fakes among the samples we've tested than real examples of old whiskey," says Higham.'"

SpringSource Acquires Hyperic, Possibly Set to Target Microsoft and IBM 130

Many sources are reporting that SpringSource has acquired Hyperic, creating a company that could go after IBM and Microsoft. SpringSource has long dreamed of being able to offer a complete open source solution that accelerates the entire build, run, manage Java application lifecycle, and Hyperic offers the last piece of the puzzle. "Regardless, the SpringSource/Hyperic combination creates a clear and present danger to IBM and Microsoft, two companies that have largely stood alone in the ability to build, run, and manage applications. It's also a significant boon to companies looking to open source to save money and improve productivity. Is it a sign of good things to come from not only SpringSource, but also open source, generally? Time will tell, but I suspect we're on the cusp of an aggressive and ambitious new phase in open-source competition."
Science

Super-Sensors To Sense Big Bang Output 50

New super-sensitive microwave detectors from the National Institute of Standards and Technology may soon tackle the question of what happened immediately following the big bang. "The new experiment will begin approximately a year from now on the Chilean desert and will consist of placing a large array of powerful NIST sensors on a telescope mounted in a converted shipping container. The detectors will look for subtle fingerprints in the CMB [cosmic microwave background] from primordial gravitational waves — ripples in the fabric of space-time from the violent birth of the universe more than 13 billion years ago. Such waves are believed to have left a faint but unique imprint on the direction of the CMB's electric field, called the 'B-mode polarization.' These waves — never before confirmed through measurements — are potentially detectable today, if sensitive enough equipment is used."
Image

Google Mows With Goats Screenshot-sm 466

Kelson writes "Google's Mountain View headquarters has fields that need to be kept clear of fire hazards. This year instead of mowing them, they took a low-carbon approach: they hired a herd of goats to eat the grass for a week. 'It costs us about the same as mowing, and goats are a lot cuter to watch than lawn mowers,' wrote Dan Hoffman."

Comment European Model... (Score 4, Informative) 265

I love how marketers in North America continue to push the idea of "European". We've all seen the infomercials where they state "This is a best selling product in Europe..." or "In Europe this retails for $60 but..."

The way that it really works in Europe is that you pay for your phone over the course of your contract. For example, if you want a phone that is $600 and you are on a 3 year agreement, you pay $16.67 as a line item on your monthly bill to pay for the cost of the phone. That's much better than the hidden subsidy cost that most (if not all) North American carriers provide.
Networking

OpenDNS To Block and Monitor Conficker Worm 175

Linker3000 writes "According to The Register, OpenDNS plans to introduce an new service that will prevent PCs infected with the Conficker (aka Downadup) malware from contacting its control servers, and will also make it easy for admins to know if even a single machine under their control has been infected by Conficker: 'Starting Monday, any networks with PCs that try to connect to the Conficker addresses will be flagged on an admin's private statistics page. The service is available for free to both businesses and home users.' With the amount of trouble this worm has caused, perhaps this is a good time to take a look at OpenDNS if you haven't done so already."

Slashdot Top Deals

PURGE COMPLETE.

Working...