Follow Slashdot stories on Twitter

 


Forgot your password?
Close
typodupeerror
×

Submission + - Add GitHub dorking to list of enterprise security concerns (itworld.com)

Submitted by chicksdaddy
chicksdaddy writes: IT World has a story today suggesting that GitHub may be a victim of its own success. Exhibit 1: "GitHub dorking:" the use of GitHub's powerful internal search engine to uncover security holes and sensitive data in published code repositories. (http://www.itworld.com/article/2921135/security/add-github-dorking-to-list-of-security-concerns.html)
In a nutshell: GitHub's runaway popularity among developers is putting employers and development shops in a tough spot. As the recent story about Uber accidentally publishing database administrator credentials in a public GitHub repository suggests, (http://arstechnica.com/security/2015/03/in-major-goof-uber-stored-sensitive-database-key-on-public-github-page/), it can be difficult even for sophisticated development organizations to grasp the nuances of how interactions with GitHub's public code repositories might work to undermine corporate security.

The ease with which developers can share and re-use code on GitHub is part of the problem, said Bill Ledingham, chief technology officer at Black Duck Software, which monitors some 300,000 open source software projects that use GitHub. Ledingham said leaked user credentials are inadvertent errors caused by developers too accustomed to the ease with which code can be borrowed, modified and resubmitted to GitHub.

"Developers in some cases are just taking the easiest path forward," he said. "They're checking in code or re-using it and not looking at some of these issues related to security."

Among the issues to watch out for are information leaks by way of vulnerabilities in GitHub.com or the GitHub API, leaks of intellectual property in published repositories and the leak of credentials and other shared secrets that could be used to compromise production applications.

Tools like the GitRob command line application developed by Michael Henriksen (http://michenriksen.com/blog/gitrob-putting-the-open-source-in-osint/) make it a simple matter to analyze all the public GitHub repositories associated with a particular organization. GitRob works by compiling the public repositories belonging to known employees of that firm, then flagging filenames in each repository that match patterns of known sensitive files.

Companies that are doing software development need to take an active interest in GitHub, determining which employees and contractors are using it and verifying that no proprietary code or sensitive information is leaking into the public domain.

Internally, data leak prevention products can identify and block the movement of proprietary code. Concerted education for developers about best practices and proper security hygiene when downloading and uploading code to shared and searchable source repositories can help prevent head slapping mistakes like the leak of database administrator credentials and private keys.

Submission + - GPU Malware Can Also Affect Windows PCs, Possibly Macs (itworld.com)

Submitted by itwbennett
itwbennett writes: A team of anonymous developers who recently created a Linux rootkit that runs on graphics cards has released a new proof-of-concept malware program that does the same on Windows. A Mac OS X implementation is also in the works. The problem the developers are trying to highlight lies not with the operating systems, such as Windows or Linux, nor with the GPU (graphics processor unit) vendors, but rather with existing security tools, which aren’t designed to scan the random access memory (RAM) used by GPUs for malware code.

Submission + - Proof-of-Concept Linux Rootkit Leverages GPUs for Stealth

Submitted by itwbennett
itwbennett writes: A team of developers has created a rootkit for Linux systems that uses the processing power and memory of graphics cards instead of CPUs in order to remain hidden. The rootkit, called Jellyfish, is a proof of concept designed to demonstrate that completely running malware on GPUs (graphics processing units) is a viable option. Such threats could be more sinister than traditional malware programs, according to the Jellyfish developers, in part because there are no tools to analyze GPU malware, they said.

Submission + - FAA Program Tests Drones Flying Beyond Pilot's Line-of-Sight (itworld.com)

Submitted by itwbennett
itwbennett writes: FAA administrator Michael P. Huerta announced Wednesday a new Pathfinder Program under which the agency has partnered with three U.S. companies to explore three key types of unmanned operations, possibly paving the way for operations such as the aerial delivery of packages as proposed by companies like Amazon.com. One of the companies the FAA has partnered with is drone manufacturer PrecisionHawk, which will be surveying crops in rural areas using unmanned aircraft flying outside of the pilot’s direct vision.

Submission + - Superfish Injects Ads In One In 25 Google Page Views (itworld.com)

Submitted by itwbennett
itwbennett writes: Google, along with researchers from the University of California at Berkeley and Santa Barbara, analyzed over 102 million page views to Google sites between June and September last year. They found that over five percent of browser visits to Google owned websites, including Google Search, are altered by computer programs that inject ads into pages. One called Superfish is responsible for a majority of those ad injections.

Submission + - C Code On GitHub Has the Most 'Ugly Hacks' (itworld.com)

Submitted by itwbennett
itwbennett writes: An analysis of GitHub data shows that C developers are creating the most ugly hacks — or are at least the most willing to admit to it. To answer the question of which programming language produces the most ugly hacks, ITworld's Phil Johnson first used the search feature on GitHub, looking for code files that contained the string 'ugly hack'. In that case, C comes up first by a wide margin, with over 181,000 code files containing that string. The rest of the top ten languages were PHP (79k files), JavaScript (38k), C++ (22k), Python (19k), Text (11k), Makefile (11k), HTML, (10k), Java (7k), and Perl (4k). Even when controlling for the number of repositories, C wins the ugly-hack-athon by a landslide, Johnson found.

Submission + - MacKeeper May Have To Pay Millions In Class-Action Suit (itworld.com)

Submitted by jfruh
jfruh writes: If you use a Mac, you probably recognize MacKeeper from the omnipresent popup ads designed to look vaguely like system warnings urging you to download the product and use it to keep your computer safe. Now the Ukranian company behind the software and the ads may have to pay millions in a class action suit that accuses them of exaggerating security problems in order to convince customers to download the software.

Submission + - The Internet Of Things Will Swamp The Cloud's Capabilities (itworld.com)

Submitted by jfruh
jfruh writes: With "the cloud" being one of the most relentlessly promoted buzzwords of the last five years, you'd be forgiven for thinking it's the solution to every problem imaginable. If you're deploying any kind of Internet of Things app or devices, the amount of data you'll be getting will quickly swamp what the public cloud is capable of — and you'll need access to a dedicated colo facility in short order.

Submission + - Court Rules Warrant Not Needed for Cell Phone Location Data (itworld.com)

Submitted by itwbennett
itwbennett writes: Historical cell tower location data is not private information owned by customers but by the mobile carrier, the U.S. Court of Appeals for the 11th Circuit ruled Tuesday. The court affirmed a district court's convictions of defendant Quartavius Davis, charged with multiple crimes in connection with a string of seven armed robberies in South Florida in 2010. Police obtained more than 11,600 location records over 67-day period from carrier MetroPCS in an effort to track Davis' movements. The location data police obtained did not pinpoint Davis' locations and it's owned by the carrier, not the customer, the court said Tuesday. 'Those cell tower records were created by MetroPCS, stored on its own premises, and subject to its control,' Judge Frank Hull wrote.

Submission + - French Lawmakers Take First Step Toward Gathering All Communications Metadata (itworld.com)

Submitted by itwbennett
itwbennett writes: Following attacks on satirical newspaper Charlie Hebdo and a supermarket in Paris in January, the government rushed out a bill that will allow French intelligence services to collect communications metadata on the entire country’s phone calls and Internet traffic, in some cases installing their own equipment on operators’ networks. Today, the French National Assembly approved the bill by 438 votes to 86. The bill still faces a number of obstacles before it can become law, though.

Submission + - Netflix Open-Sources Security Incident Management Tool (itworld.com)

Submitted by itwbennett
itwbennett writes: Netflix has released under an open-source license an internal tool it developed to manage a deluge of security alerts and incidents. Called FIDO (Fully Integrated Defense Operation), the tool is designed to research, score and categorize threats in order to speed up handling of the most urgent ones. FIDO is available on GitHub.

Submission + - Maritime cybersecurity firm: 37% of Microsoft servers vulnerable to hacking

Submitted by colinneagle
colinneagle writes: A report from maritime cybersecurity firm CyberKeel claims that spot spot checks at 50 different maritime sites revealed that 37% of the servers running Microsoft were still vulnerable because they had not been patched.

But what's most interesting is what happens when hackers can breach security in shipping environments, including one case in which "drug gangs were able to smuggle entire container loads of cocaine through Antwerp, one of Belgium's largest ports, after its hackers breached the port's IT network," said Rear Adm. Marshall Lytle, assistant commandant responsible for USCG Cyber Command.

Submission + - Singapore's Prime Minister Shares His C++ Sudoku Solver Code (itworld.com)

Submitted by itwbennett
itwbennett writes: Several weeks ago, during a speech at the Founders Forum Smart Nation Singapore Reception, Singapore’s prime minister Lee Hsien Loong said that he used to enjoy programming, and that the last program he wrote was a Sudoku solver in C++. To back that up, earlier today he announced (on Facebook and Twitter) that his code is available to download. He wrote on Facebook that he wrote the program 'several years ago' and that the code does 'a backtrack search, choosing the next cell to guess which minimises the fanout.'

Submission + - Is Vi vs. Emacs the Programmer's Version of 'Fight of the Century'? (itworld.com)

Submitted by itwbennett
itwbennett writes: Pacquiao-Mayweather is (seemingly) on everyone's mind these days, but the title 'Fight of the Century' could just as easily go to one of the perennial battles over the best tools, systems, and conventions to use or follow. As classic arguments go, there's Vi vs. Emacs, tabs vs. spaces, static typing vs. dynamic typing.

Submission + - Apple Confirms Tattoos Can Interfere With Apple Watch's Heart Rate Sensor (itworld.com) 1

Submitted by itwbennett
itwbennett writes: Some watch functions require direct contact with the skin to work. If the device can’t detect a pulse, it assumes it isn’t being worn, shutting downs apps and requiring people to enter their passcode. Turning off the wrist-detection function solves the issue, but prevents people from using Apple Pay. 'Permanent or temporary changes to your skin, such as some tattoos, can also impact heart rate sensor performance. The ink, pattern, and saturation of some tattoos can block light from the sensor, making it difficult to get reliable readings,' Apple wrote on the device’s product support page.

Slashdot Top Deals

For God's sake, stop researching for a while and begin to think!

Close