Become a fan of Slashdot on Facebook


Forgot your password?

Comment Re:Who? (Score 1) 686

A successful privilege escalation on the guest gets the attacker several things: 1) all data on the guest and 2) all the communication capabilities of the guest and 3) all the memory and computing power on the guest. Hence it gets the attacker everything he wants. Attacking the hypervisor is a way to get even more or these things, and by a different route. In extreme cases, it may not even need a privilege escalation first.

The hypervisor does not and cannot replace kernel security and hence its mere presence makes things worse.

Really, what do you think attackers are after?

Comment Re:Survey bias (Score 2) 117

That is nonsense here and rather obviously so. (The lies of the nuclear-apologists are really staggering and so is their stupidity...)

The ultrasound makes you find it earlier, you know when there is a better chance to treat it. It does not make you find more at all. Cancer has a way it making itself known at some point and it has an extremely low spontaneous remission rate (i.e. it almost never vanishes by itself).


Volkswagen Boss Blames Software Engineers For Scandal ( 473

hattig writes: Today VW's Michael Horn is testifying to Congress and has blamed the recent scandal on engineers saying: "It's the decision of a couple of software engineers, not the board members." However, 530,000 cars in the U.S. will need to be recalled for significant engine modifications, not a software fix. Only 80,000 Passats are eligible for the software fix. There is no word on the effects these modifications will have on the cars' performance, fuel consumption, etc. The BBC reports: "The issue of defeat devices at VW has been a historic problem, points out a Congress panel member questioning VW US chief Michael Horn. In 1974, VW had a run-in with US authorities regarding the use of defeat devices in 1974, and in December 2014 it recalled cars to address nox emissions."

Comment Re:Who? (Score 1) 686

It really does not matter. The "2" is a typo though (I am sure _you_ never make those....)

What you seem to fail to see is that you can still attack the kernel of a running VM under a hypervisor and then get all the benefits that brings you within the VM. But in addition, you can also attack the hypervisor and likely have other VMs on the machine which you then own. Not so when you run on the hardware itself, you then have no hypervisor to attack and no other VMs to own. Seriously, this is not difficult to see.

This, incidentally, has nothing at all to do with jails at all.

United States

NSF Awards $74.5 Million To Support Interdisciplinary Cybersecurity Research ( 8

aarondubrow writes: The National Science Foundation announced $74.5 million in grants for basic research in cybersecurity. Among the awards are projects to understand and offer reliability to cryptocurrencies; invent technologies to broadly scan large swaths of the Internet and automate the detection and patching of vulnerabilities; and establish the science of censorship resistance by developing accurate models of the capabilities of censors. According to NSF, long-term support for fundamental cybersecurity research has resulted in public key encryption, software security bug detection, spam filtering and more.

The generation of random numbers is too important to be left to chance.