Follow Slashdot blog updates by subscribing to our blog RSS feed

 


Forgot your password?
Close
typodupeerror
×

Submission + - Add GitHub dorking to list of enterprise security concerns (itworld.com)

Submitted by chicksdaddy
chicksdaddy writes: IT World has a story today suggesting that GitHub may be a victim of its own success. Exhibit 1: "GitHub dorking:" the use of GitHub's powerful internal search engine to uncover security holes and sensitive data in published code repositories. (http://www.itworld.com/article/2921135/security/add-github-dorking-to-list-of-security-concerns.html)
In a nutshell: GitHub's runaway popularity among developers is putting employers and development shops in a tough spot. As the recent story about Uber accidentally publishing database administrator credentials in a public GitHub repository suggests, (http://arstechnica.com/security/2015/03/in-major-goof-uber-stored-sensitive-database-key-on-public-github-page/), it can be difficult even for sophisticated development organizations to grasp the nuances of how interactions with GitHub's public code repositories might work to undermine corporate security.

The ease with which developers can share and re-use code on GitHub is part of the problem, said Bill Ledingham, chief technology officer at Black Duck Software, which monitors some 300,000 open source software projects that use GitHub. Ledingham said leaked user credentials are inadvertent errors caused by developers too accustomed to the ease with which code can be borrowed, modified and resubmitted to GitHub.

"Developers in some cases are just taking the easiest path forward," he said. "They're checking in code or re-using it and not looking at some of these issues related to security."

Among the issues to watch out for are information leaks by way of vulnerabilities in GitHub.com or the GitHub API, leaks of intellectual property in published repositories and the leak of credentials and other shared secrets that could be used to compromise production applications.

Tools like the GitRob command line application developed by Michael Henriksen (http://michenriksen.com/blog/gitrob-putting-the-open-source-in-osint/) make it a simple matter to analyze all the public GitHub repositories associated with a particular organization. GitRob works by compiling the public repositories belonging to known employees of that firm, then flagging filenames in each repository that match patterns of known sensitive files.

Companies that are doing software development need to take an active interest in GitHub, determining which employees and contractors are using it and verifying that no proprietary code or sensitive information is leaking into the public domain.

Internally, data leak prevention products can identify and block the movement of proprietary code. Concerted education for developers about best practices and proper security hygiene when downloading and uploading code to shared and searchable source repositories can help prevent head slapping mistakes like the leak of database administrator credentials and private keys.

Submission + - Hacker given in-game death sentence (bbc.com)

Submitted by mpicpp
mpicpp writes: A character controlled by a hacker who used exploits to dominate online game Guild Wars 2 has been put to death in the virtual world.

The character, called DarkSide, was stripped then forced to leap to their death from a high bridge.
The death sentence was carried out after players gathered evidence about the trouble the hacker had caused.

This helped the game's security staff find the player, take over their account and kill them off.

Over the past three weeks many players of the popular multi-player game Guild Wars 2 have been complaining about the activities of a character called DarkSide. About four million copies of the game have been sold.

Via a series of exploits the character was able to teleport, deal massive damage, survive co-ordinated attacks by other players and dominate player-versus-player combat.
To spur Guild Wars' creator ArenaNet to react, players gathered videos of DarkSide's antics and posted them on YouTube.

The videos helped ArenaNet's security head Chris Cleary identify the player behind DarkSide, he said in a forum post explaining what action it had taken. Mr Cleary took over the account to carry out the punishment.
The video shows DarkSide being stripped to his underwear then made to leap from a high bridge in one of the game's cities. It also shows the character being deleted by Mr Cleary.

"Oh yah, he's also banned," he wrote. Several other accounts belonging to the same player have also been shut down.

Comment Re:Not authorized is worse than unconstional. (Score 4, Interesting) 237

No, not authorized is a lighter ruling. It means tomorrow congress can pass a law explicitly allowing it, and there would be no problem cuz it wasn't ruled unconstitutional.

Not authorized isn't a lighter ruling, it's a very damning ruling against the NSA, and it's the only ruling that can be made in this case simply for the reason that there was no law on the books where Congress gave authorization for the NSA to operate like this. To put it succinctly: The NSA was ruled to be operating outside the law... which effectively makes them criminals (won't be holding my breath for any actual prosecutions, though).

Now, if Congress goes back and creates a law that Authorizes the NSA to operate in this manner, then the issue can be brought back to court for Judgement to be made on the constitutionality of the law. Then that verdict will hold a more permanent weight on the future of government surveillance and the kind of laws Congress is able to write around it.

Comment Re:Correction (Score 1) 71

It's a reference to the (IMHO unprofessional and tasteless; the Hulk should sue) title graphic that Arse Technica (sic) used for their initial story. Until this post, the only way to get to that image from here is to click the link that goes back to the previous slashdot article, and then click that link there.

Submission + - Seafloor sensors record possible eruption of underwater volcano (washington.edu)

Submitted by vinces99
vinces99 writes: If a volcano erupts at the bottom of the sea, does anyone see it? If it is Axial Seamount, about 300 miles offshore and 1 mile deep, the answer is "yes." Thanks to high-tech instruments installed last summer by the University of Washington to bring the deep sea online, what appears to be an eruption of Axial Volcano on April 23 was observed in real time by scientists on shore.

“It was an astonishing experience to see the changes taking place 300 miles away with no one anywhere nearby, and the data flowed back to land at the speed of light through the fiber-optic cable ... in milliseconds,” said John Delaney, a UW professor of oceanography who led the installation of the instruments as part of a larger effort sponsored by the National Science Foundation.

Delaney organized a workshop on campus in mid-April at which marine scientists discussed how this high-tech observatory would support their science. Then, just before midnight on April 23 until about noon the next day, the seismic activity went off the charts. The gradually increasing rumblings of the mountain were documented over recent weeks by William Wilcock, a UW marine geophysicist who studies such systems. During last week’s event, the earthquakes increased from hundreds per day to thousands, and the center of the volcanic crater dropped by about 6 feet in 12 hours.

“The only way that could have happened was to have the magma move from beneath the caldera to some other location,” Delaney said.

Submission + - Want 30 Job Offers a Month? It's Not as Great as You Think

Submitted by Anonymous Coward
An anonymous reader writes: Software engineers suffer from a problem that most other industries wish they had: too much demand. There's a great story at the Atlantic entitled Imagine Getting 30 Job Offers a Month (It Isn't as Awesome as You Might Think). This is a problem that many engineers deal with: place your resume on a job board and proceed to be spammed multiple times per day for jobs in places that you would never go to (URGENT REQUIREMENT IN DETROIT!!!!!, etc). Google "recruiter spam" and there are many tales of engineers being overwhelmed by this. One engineer, fed up by a lack of a recruiting spam blackhole, set up NoRecruitingSpam.com with directions on how to stop this modern tech scourge. How many of you slashdotters have been the victim of recruiting spam?

Submission + - CareerBuilder cyberattack delivers malware straight to employers (thestack.com)

Submitted by Anonymous Coward
An anonymous reader writes: Security threat researchers Proofpoint have uncovered an email-based phishing attack which infected businesses with malware via the CareerBuilder online job search website. The attack involved the hacker browsing job adverts across the platform and uploading malicious files during the application process, titling the documents “resume.doc” and “cv.doc.” Once the CV was submitted, an automatic email notification was sent to the business advertising the position, along with the uploaded document. In this case, Proofpoint found that as a business opens the automatic email from CareerBuilder to view the attached file the document plays on a known Word vulnerability to sneak a malicious code onto the victim’s computer. According to the threat research group, the manual attack technique although time-consuming has a higher success rate than automated tools as the email attachments are more likely to be opened by the receiver.

Submission + - Game:ref's hardware solution to cheating in eSports (redbull.com)

Submitted by Anonymous Coward
An anonymous reader writes: Cheating is a real problem in today's most popular online multiplayer games, and not just on public servers. Some of the world's top Counter-Strike: Global Offensive players have been banned by Valve's Anti-Cheat System (VACS) in recent months too, bringing a nascent eSport into disrepute. But one gamer is taking a different approach, creating a hardware solution called Game:ref to tackle the problem. Simple in design — Game:ref, which the creator hopes to fund on Kickstarter soon, compares on screen movement with your inputs — but powerful in potential, the device has the potential to catch out illegal macro users both on and offline. It's already attracting interest in the top flight too.

"I've had some people from [eSports teams] Complexity, SK Gaming, and a few high-profile streamers reach out. I would say everyone seems onboard with making online PC gaming a more enjoyable experience," says inventor David Titarenco, a former Counter-Strike pro himself. "After all, most cheating on consoles has been eradicated, why should PC be so far behind?"

Comment Re:when? (Score 1) 182

It also depends on how many internet users you need to support. For a single person, having a 30/30 or even a 50/5 should be more than adequate for the modern web, where you're not going to notice much of any slowdowns. I have 4 very heavy internet users in my household, including myself, and we were consistently choking on Cox's 50/5. To give you an idea, there are 2 people who like their Netflix, 1 person downloading and uploading class assignments (sometimes very large projects), and 1 person who needs ready VPN access to his employer with VOIP capability as well as does a lot of hobby and Open Source development (me). All 4 of us are also heavy gamers both online and offline (almost every Nintendo System and 3 separate X-box 360's in the house, along with at least 1 computer per person, though if I were inclined to share there'd be 2 computers for 3 of us, plus several 'Bones and networked 'duinoes).

For this I went to Cox's second to best tier which was 100/10 (actual speedtests performed to my personal VPS as well as various speed checkers on the web were reporting in the neighborhood of 130/17). This speed was more than adequate for us, but we found ourselves bumping and jumping the 300GB soft limit almost monthly with various game updates and downloads (If we didn't have the gaming addiction we do, we'd have been fine..and no, none of us do the CoD thing, though I'm getting sick of the roommate's Destiny obsession...) so we have moved to the Top Tier which gives 150/25 and a 400GB soft limit (the same speed tests have been averaging at 132/33, though I'm fairly certain it's just the way I have to run the cables in the crawlspace to get signal to every outlet that's causing the download degradation, and right now I'm renting so it's not really worth it for me to re-run new lines. I'm more concerned with increasing the internal wireless bandwidth by adding a dual-band access point as the router is getting overloaded on its single 2.4GHz band channel trying to support all the devices that are trying to get a piece of it).

Comment Re: Used to work at an immigration firm (Score 1) 636

by RavenLrD20k (#49588211) Attached to: Disney Replaces Longtime IT Staff With H-1B Workers

No idjit, it's called: Get that chip off your shoulder and focus your resume and your interviews into all about what you can do for that company. It took me 13 fucking years to learn that one myself, and I got absolutely nowhere until a brain injury completely broke the part that had the "victim chip". It also broke the part of my brain that processes fear. The upside, I don't play what-if scenarios to death in my head anymore. I'd say that I realized that it was an exercise in futility... but it's more a switch got flipped where I don't care one way or another anymore. The downside... it's really hard for me to empathize with other people. I can do it, but it takes a lot of effort, now. Another downside is now I have trouble pronouncing larger words and sometimes finding the right words for what I want to convey.

The point here is people are just as able to sense fear as dogs are. If you go into the interview and have a meek attitude or appear too desperate, you're gonna be circle filed in anything but the smaller Mom & Pops (and if you're too bad, even then). If you go in and make a showing like you'd be able to own the position, and it wouldn't be too much skin off your back if you didn't get it, your prospect just shot up considerably. A humble showing isn't going to get you anywhere, and neither is a "shit don't stink" showing. You've gotta show that you've got the cajones to handle anything that comes at you, but the personality that's gonna help those around you to not be completely put off.

Comment Re:How can this be leagle? (Score 1) 636

by RavenLrD20k (#49587825) Attached to: Disney Replaces Longtime IT Staff With H-1B Workers

Did you drink Coffee today? Who mows your lawn? Do you eat out at expensive restaurants every lunch?

Yes. But it's ok because it wasn't harvested by a mexican, it was harvested by a civet.

Nobody... I have a car parked out there somewhere, just can't see it.

I eat out almost every night... My wife loves it too. No expensive restaurant required.

Submission + - Leggo store detains 11-year old boy for shopping alone

Submitted by darkonc
darkonc writes: An 11 year old goes into a Leggo store in Calgary, Alberta (Canada) with $200 in hard earned cash ... and doesn't come out. When his father comes to the store to meet him for lunch, he finds his son 'detained' by the store manager and a security guard — for shopping alone. Apparently, Leggo stores have a policy of apprehending young children who shop without their parents.

Submission + - New solar telescope capture the images of sun's interior structure

Submitted by Anonymous Coward
An anonymous reader writes: The high-resolution images, taken by the New Solar Telescope (NST), show the atmosphere above the umbrae(interior structure of umbrae – the dark patches in the center of sunspots) to be finely structured, consisting of hot plasma intermixed with cool plasma jets as wide as 100 kilometers. These ground breaking images being captured by scientists at NJIT’s Big Bear Solar Observatory (BBSO). Sunspots are formed when strong magnetic fields rise up from the convection zone, a region beneath the photosphere that transfers energy from the interior of the Sun to its surface. At the surface, the magnetic fields concentrate into bundles, which prevent the hot rising plasma from reaching the surface. This energy deficit causes the magnetic bundles to cool down to temperatures about 1,000 degrees lower than their surroundings. The NST takes snapshots of the Sun every 10 seconds, which are then strung together as a video to reveal fast-evolving small explosions, plasma flows and the movement of magnetic fields. Relatively, NASA's Solar Dynamics Observatory(SDO) captured image of the sun emitting a significant solar flare on January 7th 2014.

Slashdot Top Deals

This restaurant was advertising breakfast any time. So I ordered french toast in the renaissance. - Steven Wright, comedian

Close