Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
×

Submission + - NSA Hack Attacks: Good Value For Money? (informationweek.com)

kierny writes: Leaked operations manual reveals NSA attack techniques that are not significantly better than common cybercrime capabilities, despite their high cost to government. Are US taxpayers being shortchanged by a system that could be largely replicated by spending a few tens of thousands of dollars "on the Russian private blackhat forums"?

Submission + - Why Laws Won't Save Banks From DDoS Attacks (informationweek.co.uk)

kierny writes: Rep. Mike Rogers (R-Mich.) should know better. The chairman of the House Intelligence Committee claimed to told NBC News that the Operation Ababil U.S. bank disruption DDoS campaign could be stopped, if only private businesses had unfettered access to top-flight U.S. government threat intelligence.

Not coincidentally, Rogers is the author of CISPA (now v2.0), a bill that would provide legal immunity for businesses that share threat data with the government, while allowing intelligence agencies to use it for "national security" purposes, thus raising the ire of privacy rights groups.

Just one problem: Numerous security experts have rubbished Rogers' assertion that threat intelligence would have any effect on banks' ability to defend themselves. The bank disruptions aren't cutting-edge or stealthy. They're just about packets overwhelming targeted sites, despite what Congressionally delivered intelligence might suggest.

Spam

Submission + - DDoS Feud Backfires: Bulletproof CyberBunker Busted (informationweek.co.uk)

kierny writes: The tables turned Thursday on anarchic Dutch hosting provider CyberBunker, which has been accused of backing an Internet-busting DDoS disruption campaign against anti-spam site Spamhaus. But as of Thursday morning, CyberBunker found its own "bulletproof" website knocked offline, making it the apparent victim of a sustained DDoS attack. Similarly, the website of the Stophaus.com campaign that's been organizing the attacks was also disrupted, displaying on a "database error." No one has claimed credit for the pro-Spamhaus takedowns.
China

Submission + - Debate On China Hack Attacks: Play Offense Or Defense? (informationweek.co.uk)

kierny writes: How should U.S. businesses respond to allegations that the Chinese government has been waging cyber espionage using advanced persistent threat (APT) attacks since at least 2006? Shawn Henry (who was America's top cyber cop at the FBI) and John Pescatore (who was America's top cyber security analyst at Gartner) debate the question of whether businesses should focus on information-sharing, identifying their adversaries and providing this information to law enforcement agencies; or whether the attacks should instead drive businesses to not waste time trying to ID their attackers (leave that to the government), but instead focus on better defending against all attacks by shoring up their defenses.
Security

Submission + - Security Tools Show Many Dots, Few Patterns (informationweek.com)

kierny writes: Why don't security tools do a better job of presenting information in a manner that can be easily consumed, rather than simply dumping lists and pie charts?

Your firewall, intrusion detection system, antivirus management console, LAN manager, or other security tool report tells you about its day: The quantity of events it's detected, whether antivirus is activated, which country seems to be lobbing the most attacks your way. ... Sitting through meaningless alerts risks "banner blindness" ... in which emergencies go unspotted due to input overload.But there's a relatively easy solution: Spend a few hours tearing up your existing interfaces and create your own reports, says Jonathan Grier, a digital forensics consultant who often focuses on better ways to visualize security information.

Is it time to rip out and rebuild our security tool interfaces?

China

Submission + - Don't Blame China For Security Hacks, Blame Yourself (informationweek.com)

kierny writes: Chinese APT attacks are the information security version of the Kardashians: Quick to gain news attention, but otherwise vapid, says John Pescatore, director of emerging security at the SANS Institute. Cue hype over "the Chinese are coming!":

Clearly, the panic button has been pushed. But as happens too often with outbreaks of sudden or uncontrolled anxiety, it misses the point: Don't worry about China. Worry instead if the pitiful state of your information security defenses will allow any attacker to wield nothing more than malicious email attachments to steal valuable intellectual property or even state secrets.


Security

Submission + - Modest Proposal For Stopping Hackers: Get Them Girlfriends (informationweek.com) 1

kierny writes: Hackers/crackers who get arrested are typically male and young adults--if not minors. Why is that? According to research by online psychology expert Grainne Kirwan, it's because the typical hacker "ages out" once they get a girlfriend, job, kids, and other responsibilities that make it difficult to maintain their hacking/cracking/hacktivist lifecycle. Could that finding offer a way to help keep more young hacking enthusiasts out of jail?

Submission + - Has Anonymous Ruined Online Anonymity? (informationweek.com)

kierny writes: "Calls for the death of online anonymity get invoked by everyone from the anti-cyber-bullying crowd to social networking proponents. Tie comments to an actual person, goes the reasoning, and people will think twice before trying to intimidate someone online. But recent analyses have found numerous benefits associated with being able to post anonymously. One project, for example, found that such posts helped improve the mental states of troubled teens. Likewise, commenting software maker Disqus has found that pseudonymous posters are not only the prolific posters, but also responsible for the highest quality posts."
Security

Submission + - Internet Crime Focus Of Black Hat Europe (informationweek.com)

kierny writes: ""The Internet needs crime," said reknowned cryptographer Whitfield Diffie, kicking off the Black Hat Europe conference in Amsterdam. His analysis--that there can't be good guys, without bad guys--helps explain not just the rise of black hat hackers and more recently, hacktivism, but signals that the information security profession will continue to not just be relevant, but demanded, especially as the number of data-spewing devices increases exponentially."
Android

Submission + - Smartphone Invader Tracks Your Every Move (informationweek.com)

kierny writes: "Security researcher Trevor Eckhart (of HTC data leakage discovery fame), tracing what he believed to be a virus operating in a data center and "phoning home," found the suspicious communications came from diagnostic software running on smartphones. The Carrier IQ software, installed on more than 141 million mobile phones, can track GPS location, websites visited, search queries, and all keys pressed. But in the case of the software found by Eckhart, which was running on Verizon and Sprint handsets running Android, Carrier IQ had been configured to function as a rootkit: it typically couldn't be deactivated, and in many cases its existence and background operations were completely hidden from the handset owner. Furthermore, the data collected--which carriers typically share freely with law enforcement personnel, no subpoena required, and no record of the query made public--would easily allow law enforcement personnel to track handset owners' GPS location over long periods of time. "It is a massive invasion of privacy," says Eckhart."
Privacy

Submission + - W3C Proposes Do Not Track Privacy Standard (informationweek.com)

kierny writes: "A W3C working group is crafting two standards, due out by summer 2012, to enable consumers to opt out of online tracking. Numerous big players are involved, including Google, Facebook, IBM, Mozilla, Microsoft, plus the Center for Democracy and Technology, Electronic Frontier Foundation, and Federal Trade Commission.

The first standard is Tracking Preference Expression, “to define a standard for a how a browser can tell a website that a user wants more privacy,” says W3C working group co-chairman Dr. Matthias Schunter of IBM Research. “So you send a signal, and you get a response from the website which tells you that the request has been honored.” The second standard, meanwhile, is the Tracking Compliance and Scope Specification, which details how websites should comply with Do Not Track preferences. But, don't expect Do Not Track to be active by default."

Privacy

Submission + - SEC Fines Former Executives For Privacy Breach (informationweek.com)

kierny writes: Is the privacy tide turning For the first time, the SEC has fined former executives solely for failing to safeguard their customers' data, and even fined the compliance officer for failing to create a decent security policy.
Privacy

Submission + - Do Not Track Momentum Mounts (informationweek.com)

kierny writes: "A leaked, draft version of legislation co-sponsored by Senators John Kerry and John McCain, plus an analysis of business comments to the FTC, point to stronger privacy protections for consumers, despite the already palpable outcry from advertisers."
Programming

Submission + - 10 Procrastination Avoidance Tips for Techies

kierny writes: Dice.com runs an article on 10 tips for avoiding procrastination. According to researchers, almost everyone procrastinates, and up to 20% of people do so chronically. Overcoming the tendency to procrastinate is especially difficult for techies, give that technology — while boosting productivity — also leads us to distraction, and distractions — Flickr, Skype, IM'ing, BlackBerries — stoke our desire to procrastinate. To help, a leading industrial psychologist recommends a number of techniques to avoid honing your art of delay, from deactivating email notification and killing short-cut buttons, to banishing the Dew and getting separate PCs for work and home.

Slashdot Top Deals

Kleeneness is next to Godelness.

Working...