Catch up on stories from the past week (and beyond) at the Slashdot story archive


Forgot your password?
Back for a limited time - Get 15% off sitewide on Slashdot Deals with coupon code "BLACKFRIDAY" (some exclusions apply)". ×

Submission + - Microsoft Finally Kills Windows XP Antivirus (

kierny writes: Shed a tear for enthusiasts of aging Microsoft Windows operating systems. That's because Microsoft is finally deep-sixing Windows XP — the antivirus engine, that is. After seven years of related warnings, Microsoft on July 14 stopped updating its built-in Microsoft Security Essentials software, or feeding it new signature updates. Other antivirus vendors are continuing to promise XP-compatibility for their products, as is Google for Chrome — for now.

Of course, old tech never dies — it just fades asymptotically away. But the 12% of all desktops and laptops still running XP show that breaking up [with aging Microsoft operating systems] is still hard to do.

Submission + - Google's Psychological Patch Warfare (

kierny writes: Psychologically speaking, nothing beats the power of a well-timed deadline. Love it or hate it, Google's "Project Zero" bug hunting team has been alerting vendors to vulnerabilities and giving them just 90 days to release a related fix. After that, bug details go public. Psychology and time-management expert Oliver Burkeman says such moves are no mistake. Rather, they imply Google's clever application of psychological "anchoring" and "framing" techniques to "hack" the previous, Microsoft-promulgated "we'll patch it when we patch it, and don't try to rush us" mentality.

Submission + - Report: Mercenaries Behind APT Attacks (

kierny writes: An increasing number of online attacks are not being launched by governments or carder gangs, but rather by opportunistic mercenaries who sell whatever they can steal, to the highest bidder, information security consultancy Taia Global says in a new report:

"These mercenary hacker groups range from small groups with little funding to specialty shops run by ex-government spooks, to highly financed criminal groups who use similar if not identical tactics to nation state actors. That they are rarely discovered is due in part to their skill level and in part to being misidentified as a state actor instead of a non-state actor if they are discovered."

Cue implications for attribution and sanctions — and the possibility that the Sony Pictures hack blamed on North Korea was actually the work of mercenaries, says Europol cybersecurity advisor Alan Woodward.

Submission + - 'Endrun' Networks: Help in Danger Zones (

kierny writes: Drawing on networking protocols designed to support NASA's interplanetary missions, two information security researchers have created a networking system that's designed to transmit information securely and reliably in even the worst conditions. Dubbed Endrun, and debuted at Black Hat Europe, its creators hope the delay-tolerant and disruption-tolerant system — which runs on Raspberry Pi — could be deployed everywhere from Ebola hot zones in Liberia, to war zones in Syria, to demonstrators Ferguson.

Submission + - Feds Fumble Spyware Story (

kierny writes: If selling spyware is illegal, is it OK to give it away for free? "Selling spyware is not just reprehensible, it's a crime," says assistant attorney general Leslie R. Caldwell, announcing the indictment of a Pakistani CEO for making and selling spyware software, which officials have warned could be used by predators or domestic abusers. So why have 245 law enforcement agencies across 35 states — plus the U.S. Marshals — used public funds to buy and distribute the spyware for free to families, when such software could likewise be abused?

Submission + - NASA Eyes Crew Deep Sleep Option for Mars Mission (

astroengine writes: A NASA-backed study explores an innovative way to dramatically cut the cost of a human expedition to Mars — put the crew in stasis. The deep sleep, called torpor, would reduce astronauts’ metabolic functions with existing medical procedures. Torpor also can occur naturally in cases of hypothermia. “Therapeutic torpor has been around in theory since the 1980s and really since 2003 has been a staple for critical care trauma patients in hospitals," aerospace engineer Mark Schaffer, with SpaceWorks Enterprises in Atlanta, said at the International Astronomical Congress in Toronto this week. "Protocols exist in most major medical centers for inducing therapeutic hypothermia on patients to essentially keep them alive until they can get the kind of treatment that they need.” Coupled with intravenous feeding, a crew could be put in hibernation for the transit time to Mars, which under the best-case scenario would take 180 days one-way.

Submission + - 5 Million Google Passwords Leaked (

kierny writes: After first appearing on multiple Russian cybercrime boards, a list of 5 million Google account usernames — which of course double as email usernames — are circulating via file-sharing sites. Experts say the information most likely didn't result from a hack of any given site, including Google, but was rather amassed over time, likely via a number of hacks of smaller sites, as well as via malware infections.

Numerous commenters who have found their email addresses included in the list of exposed credentials say the included password appears to date from at least three years ago, if not longer. That means anyone who's changed their Google/Gmail password in the last three years is likely safe from account takeover. But how many people haven't changed their password in that timeframe?

Submission + - Bitcoin, Meet Darwin: Crypto Currency's Future (

kierny writes: Today, Bitcoin, tomorrow, the dollar? Former Central Intelligence Agency CTO Gus Hunt says governments will learn from today's crypto currencies and use them to fashion future government-protected monetary systems. But along the way, expect first-movers such as Bitcoin to fall, in a repeat of the fate of AltaVista, Napster, and other early innovators. But the prospect of fashioning a better, more stable crypto currency system — and the likelihood that Bitcoin may one day burn — is good news for anyone who cares about crypto currencies, as well as the future and reliability of our monetary systems.

Submission + - NSA Hack Attacks: Good Value For Money? (

kierny writes: Leaked operations manual reveals NSA attack techniques that are not significantly better than common cybercrime capabilities, despite their high cost to government. Are US taxpayers being shortchanged by a system that could be largely replicated by spending a few tens of thousands of dollars "on the Russian private blackhat forums"?

Submission + - Why Laws Won't Save Banks From DDoS Attacks (

kierny writes: Rep. Mike Rogers (R-Mich.) should know better. The chairman of the House Intelligence Committee claimed to told NBC News that the Operation Ababil U.S. bank disruption DDoS campaign could be stopped, if only private businesses had unfettered access to top-flight U.S. government threat intelligence.

Not coincidentally, Rogers is the author of CISPA (now v2.0), a bill that would provide legal immunity for businesses that share threat data with the government, while allowing intelligence agencies to use it for "national security" purposes, thus raising the ire of privacy rights groups.

Just one problem: Numerous security experts have rubbished Rogers' assertion that threat intelligence would have any effect on banks' ability to defend themselves. The bank disruptions aren't cutting-edge or stealthy. They're just about packets overwhelming targeted sites, despite what Congressionally delivered intelligence might suggest.


Submission + - DDoS Feud Backfires: Bulletproof CyberBunker Busted (

kierny writes: The tables turned Thursday on anarchic Dutch hosting provider CyberBunker, which has been accused of backing an Internet-busting DDoS disruption campaign against anti-spam site Spamhaus. But as of Thursday morning, CyberBunker found its own "bulletproof" website knocked offline, making it the apparent victim of a sustained DDoS attack. Similarly, the website of the campaign that's been organizing the attacks was also disrupted, displaying on a "database error." No one has claimed credit for the pro-Spamhaus takedowns.

Submission + - Debate On China Hack Attacks: Play Offense Or Defense? (

kierny writes: How should U.S. businesses respond to allegations that the Chinese government has been waging cyber espionage using advanced persistent threat (APT) attacks since at least 2006? Shawn Henry (who was America's top cyber cop at the FBI) and John Pescatore (who was America's top cyber security analyst at Gartner) debate the question of whether businesses should focus on information-sharing, identifying their adversaries and providing this information to law enforcement agencies; or whether the attacks should instead drive businesses to not waste time trying to ID their attackers (leave that to the government), but instead focus on better defending against all attacks by shoring up their defenses.

Submission + - Security Tools Show Many Dots, Few Patterns (

kierny writes: Why don't security tools do a better job of presenting information in a manner that can be easily consumed, rather than simply dumping lists and pie charts?

Your firewall, intrusion detection system, antivirus management console, LAN manager, or other security tool report tells you about its day: The quantity of events it's detected, whether antivirus is activated, which country seems to be lobbing the most attacks your way. ... Sitting through meaningless alerts risks "banner blindness" ... in which emergencies go unspotted due to input overload.But there's a relatively easy solution: Spend a few hours tearing up your existing interfaces and create your own reports, says Jonathan Grier, a digital forensics consultant who often focuses on better ways to visualize security information.

Is it time to rip out and rebuild our security tool interfaces?


Submission + - Don't Blame China For Security Hacks, Blame Yourself (

kierny writes: Chinese APT attacks are the information security version of the Kardashians: Quick to gain news attention, but otherwise vapid, says John Pescatore, director of emerging security at the SANS Institute. Cue hype over "the Chinese are coming!":

Clearly, the panic button has been pushed. But as happens too often with outbreaks of sudden or uncontrolled anxiety, it misses the point: Don't worry about China. Worry instead if the pitiful state of your information security defenses will allow any attacker to wield nothing more than malicious email attachments to steal valuable intellectual property or even state secrets.


Submission + - Modest Proposal For Stopping Hackers: Get Them Girlfriends ( 1

kierny writes: Hackers/crackers who get arrested are typically male and young adults--if not minors. Why is that? According to research by online psychology expert Grainne Kirwan, it's because the typical hacker "ages out" once they get a girlfriend, job, kids, and other responsibilities that make it difficult to maintain their hacking/cracking/hacktivist lifecycle. Could that finding offer a way to help keep more young hacking enthusiasts out of jail?

Intel CPUs are not defective, they just act that way. -- Henry Spencer