Follow Slashdot blog updates by subscribing to our blog RSS feed

 



Forgot your password?
typodupeerror
×
Security

Adobe's Latest Zero-Day Exploit Repurposed, Targeting Adult Websites 203

MojoKid writes Adobe issued a patch for bug CVE-2015-0311, one that exposes a user's browser to become vulnerable to code injection, and the now infamous Angler EK (Exploit Kit). To fall victim to this kind of attack, all someone needs to do is visit a website with compromised Flash files, at which point the attacker can inject code and utilize Angler EK, which has proven to be an extremely popular tool over the past year. This particular version of Angler EK is different, however. For starters, it makes use of obfuscated JavaScript and attempts to detect virtual machines and anti-virus products. Its target audience is also rather specific: porn watchers. According to FireEye, which has researched the CVE-2015-0311 vulnerability extensively, this exploit has reached people via banner ads on popular adult websites. It was also noted that even a top 1000 website was affected, so it's not as though victims are surfing to the murkiest depths of the web to come in contact with it.
Encryption

Justice Department: Default Encryption Has Created a 'Zone of Lawlessness' 431

Jason Koebler writes: Leslie Caldwell, an assistant attorney general at the Justice Department, said Tuesday that the department is "very concerned" by the Google's and Apple's decision to automatically encrypt all data on Android and iOS devices.

"We understand the value of encryption and the importance of security," she said. "But we're very concerned they not lead to the creation of what I would call a 'zone of lawlessness,' where there's evidence that we could have lawful access through a court order that we're prohibited from getting because of a company's technological choices.

Comment Re:Slave Labour is certainly profitable (Score 1) 534

Apple repeatedly said they would manufacture in the US should it be able to man those plants and that is not the case right now. There's no manufacturing plant in the US that would be able to sustain the volume requirements.

Tim Cook often commented on this. Best they could do for now was to build Mac Pros in US. It's a much smaller volume.

Comment Re:Chromebook Shmomebook (Score 1) 169

Why doesn't RedHat, or Oracle, or SUSE, or someone else run Linux through the compliance tests?

Primarily? Because it won't pass the testing without a lot of work. In particular, there are negative assertion tests on header files (some things are not allowed to be dragged into the namespace, and the header are promiscuous). There's also a whole bunch of testing having to do with full and almost-full devices. There are also signal issues and process group membership issues. For example, you can "escape" an exclusion group on Linux by setting your default group to one of your other groups; Linux overwrites the membership in cr_groups[0] as a synonym for cr_gid, and doesn't handle POSIX saved IDs quite right, either (Neither do the BSDs, so this isn't a Linux-only problem).

Last time I attempted to run the test suit on Linux as a lark, there were about 20K failures (mostly tests not compiling because of it bailing out over the header file issues. There are also some parts of the system that have been subsumed by systemd; this isn't intrinsically a problem on its own, so long as the system *also* supports flat config files as an addendum, at least for some aspects of logging.

Also, getting the UUCP to work over USB serial dongles is likely to be something of a bear, unless you make the HDB modifications for handling the "rung indicate" as a notification to take the shared file lock on the callout device so the getty's don't start trying to chat with each other.

Finally, there some considerable legal/licensing issues for the trademark.

Slashdot Top Deals

An authority is a person who can tell you more about something than you really care to know.

Working...