Become a fan of Slashdot on Facebook

 



Forgot your password?
typodupeerror
×
Microsoft

Submission + - How Assumptions Are Making Us All Insecure (threatpost.com)

Trailrunner7 writes: In the space of a given year, untold thousands of vulnerabilities are found in operating systems, applications and plug-ins. In many cases, the affected vendors fix the flaws, either with a patch, a workaround or some other mitigation. But there's also a huge population of security bugs that vendors never fix because they're deemed unexploitable, an assumption that may be turning into a serious mistake for software makers. Microsoft made such a call earlier this year, after researchers at Core Security informed the company that they had found a vulnerability in the Microsoft Virtual PC software. The flaw, which affected the virtual machine monitor (VMM) in Virtual PC, could enable an attacker to use applications running in user-space on a guest OS to access portions of the Virtual PC memory that should be inaccessible to those applications. This gives the attacker the ability to bypass anti-exploitation technologies in the underlying operating system and exploit flaws in the OS that otherwise would not be exploitable.

The difference in this case, experts say, is that the Virtual PC vulnerability is the symptom of a larger problem lurking beneath the surface: assuming that protections such as ASLR, DEP and SafeSEH will always be around to save us. "We're less worried about this particular vulnerability than we are about the now-exposed (incorrect) assumption that various security mechanisms will always be in place. It's obvious that a complete re-calibration of exploit potential for uncategorized bugs will become necessary if vulnerabilities like the one described here remain in our fielded systems. Not so good for Windows 7," Gary McGraw of Cigital said.

Image

Jetman Attempts Intercontinental Flight Screenshot-sm 140

Last year we ran the story of Yves Rossy and his DIY jetwings. Yves spent $190,000 and countless hours building a set of jet-powered wings which he used to cross the English Channel. Rossy's next goal is to cross the Strait of Gibraltar, from Tangier in Morocco and Tarifa on the southwestern tip of Spain. From the article: "Using a four-cylinder jet pack and carbon fibre wings spanning over 8ft, he will jump out of a plane at 6,500 ft and cruise at 130 mph until he reaches the Spanish coast, when he will parachute to earth." Update 18:57 GMT: mytrip writes: "Yves Rossy took off from Tangiers but five minutes into an expected 15-minute flight he was obliged to ditch into the wind-swept waters."
Music

Brian Eno Releases Second iPhone App 196

Brian Eno, or as he is known to many in my office, "God," has released his second iPhone App. A followup to Bloom, this one is called Trope and supposedly creates darker music. You create music by drawing shapes on the iPhone's screen.
Windows

Windows 7 Beta Released To Public After Delay 848

Z80xxc! writes "The Windows 7 Beta release is now available for download by the general public, in 32-bit and 64-bit flavors. Microsoft had previously announced availability around 3 PM PST on Friday, but after unexpected numbers of people proved to be interested in the download, had to postpone it to add more servers."
Programming

How to Search Today's Usenet For Programming Information? 230

DeadlyBattleRobot writes "I've been using Usenet searches since about 1995 to get programming information, sample code, etc., mostly for those standard APIs that are never documented well enough in the official documentation. At first I used dejanews, and now Google Groups (Google bought dejanews). Over the last few years, I've noticed a steady decline in the quantity of search results on programming topics on Usenet from Google, increasing difficulty with their search UI and result pages, and today I find I'm completely unable to get a working Usenet search on their advanced group search page. I'm used to searching on 'microsoft.*' or 'comp.*,' sometimes supplemented with variations like '*microsoft*' or 'comp*.' As an example, try to find a post from the 1996-1998 time period on 'database' in either the comp.* or microsoft.* hierarchies, and if you can do it, please show your search expression. There should be thousands of results, but I'm getting the result 'Your search — database group:comp.* — did not match any documents.'"
Operating Systems

What Normal Users Can Expect From Ubuntu 8.10 511

notthatwillsmith writes "With Ubuntu 8.10 due to be released in just a few days, Maximum PC pored through all the enhancements, updates, and new features that are bundled into the release of Intrepid Ibex and separated out the new features that are most exciting for Linux desktop users. Things to be excited about? With new versions of GNOME and X.Org, there's quite a bit, ranging from the context-sensitive Deskbar search to an audio and video compatible SIP client to the new Network Manager (manage wired, Wi-Fi, VPN, and cellular broadband connections in one place)."
Security

Reliable, Free Anti-Virus Software? 586

oahazmatt writes "Some time ago my wife was having severe issues on her laptop. (A Dell Inspiron, if that helps.) I eventually found the cause to be McAfee, which took about an hour to remove fully. I installed AVG on her system to replace McAfee, but we have since found that AVG is causing problems with her laptop's connection to our wireless network. She's not thrilled about a wired connection as the router is on the other end of the house. We're looking for some good, open-source or free personal editions of anti-virus software. So, who on Slashdot trusts what?" When school required a Windows laptop, I used Clam AV, and the machine seemed to do as well as most classmates'. What have you found that works?
Cellphones

Security Flaw In Android Web Browser 59

r writes "The New York Times reports on a security flaw discovered in the new Android phones. The article is light on details, but it hints at a security hole in the browser, allowing for trojans to install themselves in the same security partition as the browser: 'The risk in the Google design, according to Mr. Miller, who is a principal security analyst at Independent Security Evaluators in Baltimore, lies in the danger from within the Web browser partition in the phone. It would be possible, for example, for an intruder to install software that would capture keystrokes entered by the user when surfing to other Web sites. That would make it possible to steal identity information or passwords.'"
Biotech

Couch Potato Gene Identified In Fruit Flies 105

Pickens writes "University of Pennsylvania biologists have discovered a mutation in fruit flies aptly named the 'couch potato' gene that allows them to simply chill out — entering a mild state of quasi-hibernation known as diapause, when winter arrives. 'It's not like they're bears sleeping in a cave,' says Paul Schmidt. 'They just look like they're a little bit more sluggish.' The couch potato gene, first discovered in the early 1990s, got its nickname because flies with mutations in the gene became really sluggish and behaved abnormally. Little is known about the underlying evolutionary genetic architecture, but in diapause, the slacking off is far less severe. The flies' bodily functions slow down, and they are better able to tolerate stress. The fruit fly gene may have implications for human health, as it can help biologists study the function of the nervous system and diseases such as epilepsy, refuting a recent statement by a political candidate that fruit fly research has 'little or nothing to do with the public good.'"
Windows

What Does It Take To Get a PC With XP? 513

An anonymous reader writes "Christopher Null tried to buy a computer with Windows XP pre-installed on it from the United States' nine biggest PC makers. His findings: You can get one, but be prepared to fib."

Slashdot Top Deals

Beware of all enterprises that require new clothes, and not rather a new wearer of clothes. -- Henry David Thoreau

Working...