Follow Slashdot stories on Twitter

 



Forgot your password?
typodupeerror

+ - Google's Psychological Patch Warfare->

Submitted by kierny
kierny writes: Psychologically speaking, nothing beats the power of a well-timed deadline. Love it or hate it, Google's "Project Zero" bug hunting team has been alerting vendors to vulnerabilities and giving them just 90 days to release a related fix. After that, bug details go public. Psychology and time-management expert Oliver Burkeman says such moves are no mistake. Rather, they imply Google's clever application of psychological "anchoring" and "framing" techniques to "hack" the previous, Microsoft-promulgated "we'll patch it when we patch it, and don't try to rush us" mentality.
Link to Original Source

+ - Report: Mercenaries Behind APT Attacks->

Submitted by kierny
kierny writes: An increasing number of online attacks are not being launched by governments or carder gangs, but rather by opportunistic mercenaries who sell whatever they can steal, to the highest bidder, information security consultancy Taia Global says in a new report:

"These mercenary hacker groups range from small groups with little funding to specialty shops run by ex-government spooks, to highly financed criminal groups who use similar if not identical tactics to nation state actors. That they are rarely discovered is due in part to their skill level and in part to being misidentified as a state actor instead of a non-state actor if they are discovered."

Cue implications for attribution and sanctions — and the possibility that the Sony Pictures hack blamed on North Korea was actually the work of mercenaries, says Europol cybersecurity advisor Alan Woodward.
Link to Original Source

+ - 'Endrun' Networks: Help in Danger Zones->

Submitted by kierny
kierny writes: Drawing on networking protocols designed to support NASA's interplanetary missions, two information security researchers have created a networking system that's designed to transmit information securely and reliably in even the worst conditions. Dubbed Endrun, and debuted at Black Hat Europe, its creators hope the delay-tolerant and disruption-tolerant system — which runs on Raspberry Pi — could be deployed everywhere from Ebola hot zones in Liberia, to war zones in Syria, to demonstrators Ferguson.
Link to Original Source

+ - Feds Fumble Spyware Story->

Submitted by kierny
kierny writes: If selling spyware is illegal, is it OK to give it away for free? "Selling spyware is not just reprehensible, it's a crime," says assistant attorney general Leslie R. Caldwell, announcing the indictment of a Pakistani CEO for making and selling spyware software, which officials have warned could be used by predators or domestic abusers. So why have 245 law enforcement agencies across 35 states — plus the U.S. Marshals — used public funds to buy and distribute the spyware for free to families, when such software could likewise be abused?
Link to Original Source

+ - NASA Eyes Crew Deep Sleep Option for Mars Mission->

Submitted by astroengine
astroengine writes: A NASA-backed study explores an innovative way to dramatically cut the cost of a human expedition to Mars — put the crew in stasis. The deep sleep, called torpor, would reduce astronauts’ metabolic functions with existing medical procedures. Torpor also can occur naturally in cases of hypothermia. “Therapeutic torpor has been around in theory since the 1980s and really since 2003 has been a staple for critical care trauma patients in hospitals," aerospace engineer Mark Schaffer, with SpaceWorks Enterprises in Atlanta, said at the International Astronomical Congress in Toronto this week. "Protocols exist in most major medical centers for inducing therapeutic hypothermia on patients to essentially keep them alive until they can get the kind of treatment that they need.” Coupled with intravenous feeding, a crew could be put in hibernation for the transit time to Mars, which under the best-case scenario would take 180 days one-way.
Link to Original Source

+ - 5 Million Google Passwords Leaked->

Submitted by kierny
kierny writes: After first appearing on multiple Russian cybercrime boards, a list of 5 million Google account usernames — which of course double as email usernames — are circulating via file-sharing sites. Experts say the information most likely didn't result from a hack of any given site, including Google, but was rather amassed over time, likely via a number of hacks of smaller sites, as well as via malware infections.

Numerous commenters who have found their email addresses included in the list of exposed credentials say the included password appears to date from at least three years ago, if not longer. That means anyone who's changed their Google/Gmail password in the last three years is likely safe from account takeover. But how many people haven't changed their password in that timeframe?

Link to Original Source

+ - Bitcoin, Meet Darwin: Crypto Currency's Future->

Submitted by kierny
kierny writes: Today, Bitcoin, tomorrow, the dollar? Former Central Intelligence Agency CTO Gus Hunt says governments will learn from today's crypto currencies and use them to fashion future government-protected monetary systems. But along the way, expect first-movers such as Bitcoin to fall, in a repeat of the fate of AltaVista, Napster, and other early innovators. But the prospect of fashioning a better, more stable crypto currency system — and the likelihood that Bitcoin may one day burn — is good news for anyone who cares about crypto currencies, as well as the future and reliability of our monetary systems.
Link to Original Source

+ - NSA Hack Attacks: Good Value For Money?->

Submitted by kierny
kierny writes: Leaked operations manual reveals NSA attack techniques that are not significantly better than common cybercrime capabilities, despite their high cost to government. Are US taxpayers being shortchanged by a system that could be largely replicated by spending a few tens of thousands of dollars "on the Russian private blackhat forums"?
Link to Original Source

+ - Why Laws Won't Save Banks From DDoS Attacks->

Submitted by kierny
kierny writes: Rep. Mike Rogers (R-Mich.) should know better. The chairman of the House Intelligence Committee claimed to told NBC News that the Operation Ababil U.S. bank disruption DDoS campaign could be stopped, if only private businesses had unfettered access to top-flight U.S. government threat intelligence.

Not coincidentally, Rogers is the author of CISPA (now v2.0), a bill that would provide legal immunity for businesses that share threat data with the government, while allowing intelligence agencies to use it for "national security" purposes, thus raising the ire of privacy rights groups.

Just one problem: Numerous security experts have rubbished Rogers' assertion that threat intelligence would have any effect on banks' ability to defend themselves. The bank disruptions aren't cutting-edge or stealthy. They're just about packets overwhelming targeted sites, despite what Congressionally delivered intelligence might suggest.

Link to Original Source
Spam

+ - DDoS Feud Backfires: Bulletproof CyberBunker Busted->

Submitted by kierny
kierny writes: The tables turned Thursday on anarchic Dutch hosting provider CyberBunker, which has been accused of backing an Internet-busting DDoS disruption campaign against anti-spam site Spamhaus. But as of Thursday morning, CyberBunker found its own "bulletproof" website knocked offline, making it the apparent victim of a sustained DDoS attack. Similarly, the website of the Stophaus.com campaign that's been organizing the attacks was also disrupted, displaying on a "database error." No one has claimed credit for the pro-Spamhaus takedowns.
Link to Original Source
China

+ - Debate On China Hack Attacks: Play Offense Or Defense? ->

Submitted by kierny
kierny writes: How should U.S. businesses respond to allegations that the Chinese government has been waging cyber espionage using advanced persistent threat (APT) attacks since at least 2006? Shawn Henry (who was America's top cyber cop at the FBI) and John Pescatore (who was America's top cyber security analyst at Gartner) debate the question of whether businesses should focus on information-sharing, identifying their adversaries and providing this information to law enforcement agencies; or whether the attacks should instead drive businesses to not waste time trying to ID their attackers (leave that to the government), but instead focus on better defending against all attacks by shoring up their defenses.
Link to Original Source
Security

+ - Security Tools Show Many Dots, Few Patterns->

Submitted by kierny
kierny writes: Why don't security tools do a better job of presenting information in a manner that can be easily consumed, rather than simply dumping lists and pie charts?

Your firewall, intrusion detection system, antivirus management console, LAN manager, or other security tool report tells you about its day: The quantity of events it's detected, whether antivirus is activated, which country seems to be lobbing the most attacks your way. ... Sitting through meaningless alerts risks "banner blindness" ... in which emergencies go unspotted due to input overload.But there's a relatively easy solution: Spend a few hours tearing up your existing interfaces and create your own reports, says Jonathan Grier, a digital forensics consultant who often focuses on better ways to visualize security information.

Is it time to rip out and rebuild our security tool interfaces?
Link to Original Source

China

+ - Don't Blame China For Security Hacks, Blame Yourself->

Submitted by kierny
kierny writes: Chinese APT attacks are the information security version of the Kardashians: Quick to gain news attention, but otherwise vapid, says John Pescatore, director of emerging security at the SANS Institute. Cue hype over "the Chinese are coming!":

Clearly, the panic button has been pushed. But as happens too often with outbreaks of sudden or uncontrolled anxiety, it misses the point: Don't worry about China. Worry instead if the pitiful state of your information security defenses will allow any attacker to wield nothing more than malicious email attachments to steal valuable intellectual property or even state secrets.


Link to Original Source
Security

+ - Modest Proposal For Stopping Hackers: Get Them Girlfriends-> 1

Submitted by kierny
kierny writes: Hackers/crackers who get arrested are typically male and young adults--if not minors. Why is that? According to research by online psychology expert Grainne Kirwan, it's because the typical hacker "ages out" once they get a girlfriend, job, kids, and other responsibilities that make it difficult to maintain their hacking/cracking/hacktivist lifecycle. Could that finding offer a way to help keep more young hacking enthusiasts out of jail?
Link to Original Source

+ - Has Anonymous Ruined Online Anonymity? ->

Submitted by
kierny
kierny writes: "Calls for the death of online anonymity get invoked by everyone from the anti-cyber-bullying crowd to social networking proponents. Tie comments to an actual person, goes the reasoning, and people will think twice before trying to intimidate someone online. But recent analyses have found numerous benefits associated with being able to post anonymously. One project, for example, found that such posts helped improve the mental states of troubled teens. Likewise, commenting software maker Disqus has found that pseudonymous posters are not only the prolific posters, but also responsible for the highest quality posts."
Link to Original Source

The last person that quit or was fired will be held responsible for everything that goes wrong -- until the next person quits or is fired.

Working...