Slashdot is powered by your submissions, so send in your scoop

 



Forgot your password?
typodupeerror
×

Submission + - 'BlueLeaks' Exposes Files from Hundreds of Police Departments (krebsonsecurity.com)

bmimatt writes: Hundreds of thousands of potentially sensitive files from police departments across the United States were leaked online last week. The collection, dubbed “BlueLeaks” and made searchable online, stems from a security breach at a Texas web design and hosting company that maintains a number of state law enforcement data-sharing portals.

The collection — nearly 270 gigabytes in total — is the latest release from Distributed Denial of Secrets (DDoSecrets), an alternative to Wikileaks that publishes caches of previously secret data.

Submission + - Crooks Abuse Google Analytics To Conceal Theft of Payment Card Data (arstechnica.com)

An anonymous reader writes: Hackers are abusing Google Analytics so that they can more covertly siphon stolen credit card data out of infected ecommerce sites, researchers reported on Monday. Payment card skimming used to refer solely to the practice of infecting point-of-sale machines in brick-and-mortar stores. The malware would extract credit card numbers and other data. Attackers would then use or sell the stolen information so it could be used in payment card fraud. One challenge in pulling off the hack is bypassing website security policies or concealing the exfiltration of massive amounts of sensitive data from endpoint security applications installed on the infected network. Researchers from Kaspersky Lab on Monday said that they have recently observed about two dozen infected sites that found a novel way to achieve this. Instead of sending it to attacker-controlled servers, the attackers send it to Google Analytics accounts they control. Since the Google service is so widely used, ecommerce site security policies generally fully trust it to receive data.

“Google Analytics is an extremely popular service (used on more than 29 million sites, according to BuiltWith) and is blindly trusted by users,” Kaspersky Lab researcher Victoria Vlasova wrote here. “Administrators write *.google-analytics.com into the Content-Security-Policy header (used for listing resources from which third-party code can be downloaded), allowing the service to collect data. What’s more, the attack can be implemented without downloading code from external sources.” The researcher added: “To harvest data about visitors using Google Analytics, the site owner must configure the tracking parameters in their account on analytics.google.com, get the tracking ID (trackingId, a string like this: UA-XXXX-Y), and insert it into the web pages together with the tracking code (a special snippet of code). Several tracking codes can rub shoulders on one site, sending data about visitors to different Analytics accounts.” The “UA-XXXX-Y” refers to the tracking ID that Google Analytics uses to tell one account from another. As demonstrated in the following screenshot, showing malicious code on an infected site, the IDs (underlined) can easily blend in with legitimate code.

Comment YouTube being deceptive here (Score 1) 409

a large percentage of the accounts that were removed were being retroactively accused of 'hate speech' The videos involved were often 10 or more years old. This is causing long time YouTubers (especially conservative ones) to delete their back catalog so that they do not get burned by the retroactive culling of content creators.

Comment Nothing to see here (Score 1) 223

The cops review footage from private security cameras all the time.
It used to be that they only bothered with commercial installations because
it was easier to determine that they had a possible view of a crime scene,
may have caught someone arriving or leaving etc. Even if that
business had no other connection to the investigation.
This has always been asked, not ordered.

Now due to residential ubiquity, and the wonders of The Cloud,
the tradition has trickled into civilian awareness.

Comment Re:Really? (Score 1) 80

Yes, absolutely. Someone who wants all the people to prosper rather than having 1% of the population take all the money and pay no taxes is pretty much the definition of a leach. To avoid being a leach one takes millions of immorally gained cash from ones parent, commissions people to provide services then never pays for them, gets their golfing trips paid for by the masses at ridiculous price gouging rates, accepts help from dangerous dictators, befriends as many human rights violators as possible, attempts to undermine the press, and grabs 'em by the pussy whenever he can! I can't believe everyone doesn't understand this simple and obvious logic!

Honestly, the top %20 are a worse problem than the top 1%.

Comment Re:Combust much? (Score 1) 284

At least one. I remember being at a furniture store looking around and planning how I would furnish my place after college graduation. This was in Bellevue, WA, not far from Microsoft, around 1995/96. There was a brand new Porsche Boxter parked out front. It still had temporary registration taped in the back window. I was looking at it through the window when I noticed some smoke and it was suddenly engulfed in flames. The FD showed up and put the fire out with some thick foam. So, I can say that parked IC engine cars can burst into flame. I have no data about the rate at which this happens or whether it is greater or less than BEVs, but I would guess that data is available.

I saw something similar when walking home from work back in 1987. A souped up 1978 Corvette pulled into a a gas station lot... NOT up to the pumps. The driver gets out of the car and walks into the convince store/ office of the business. A few seconds later there is a soft *Wump* and flames appear from under the front wheel wells. Seconds after that the whole front end of the vehicle is engulfed. Before FD arrived and foamed it, the car had mostly burned down.

Comment Code reading (Score 1) 337

I don't really read code unless I've run into a snarl of conditional logic. Then it feels like I'm kind of sounding out the logic expressions while cursing under my breath about some asshat that doesn't know what state-machines are for.

What I am doing is watching for declarations, assignments, usages, language structures and flow that eventually lead me to see what a chunk of code is doing. This happens most often when I'm trying to understand what a low-level function is doing. Higher-level stuff is usually named well enough that it is easy to see flow like reading dialog in a screen play or novel. Poor formatting slows this down to an annoying degree.
  If I had to give it a concise description... It is like contemplating a painting, or a photograph, until all of it's elements make sense.

One exception is when reading assembly language. I'm keeping a running tally in my head of the key variables and operations as I scan down the list of operations in a function. I'm watching for common idioms and macros, etc. Again this eventually results in abstracting all of it away and thinking of the function. This feels to me kind of like sounding out a new word.

[I was programming in BASIC at 11, and transitioned into 6502 and Z-80 assembly pretty quickly. BASIC was just too slow for what I was interested in.
I guess I was in my mid 20's before I did anything professionally with C/C++, or anything other than assembler languages, for that matter.]

Comment CNN Done Fucked Up (Score 1) 944

It really doesn't matter if the reddit clown got threatened or not in the legal sense at this point. It doesn't matter that this clown had a long history of shitposting on the internet. It doesn't even matter that the poor cockroach nearly got outed by CNN.

What CNN did to this troll *and bragged about it publicly* was incredibly stupid. Lighting a dumpster fire in that particularly dark neighborhood of the internet, to find one rat, tends to piss off all the other rats that live there. The problem for CNN is this: Now all of those angry rats are going to stop rattle-canning random dicks-in-butts on the brickwork and refocus their considerable talent at tormenting people onto a Mainstream Media Organization.

After all the crap flinging CNN has done recently, and the revelations about their extremely cynical view of journalistic ethics... I can't say I have much sympathy for them. They didn't just piss off all the trolls. They pissed off pretty much everyone in alt-media, across the entire political spectrum.

It would not surprise me in the least to learn that Trump had a pretty good idea that something like this would happen when that meme got retweeted on his Twitter.

Comment Re:Of course the callers were aware (Score 1) 185

Years ago I was Director of Ops at a small American Call Center. We had several clients create situations where the Sales staff was tricked into doing something illegal. Fortunately, I had a good rapport with several of the call-floor managers.

In one case a couple of floor managers came to me with concerns about what the client was mailing out to their marks. It turns out that what the customers were calling us to understand was essentially an illegal attempt to scare home-owners into a refinancing loan. The mailer looked like a Notice of Default. Our script was to calm the caller down and explain that to avoid the loan default they should follow through with a refinance loan, collecting their PII and pass it on to the Client's office.

We were told by the Client that the Notice of Default they sent were legit. They showed us examples of what they claimed they were sending out. But when we finally had a caller fax us a copy of the letter they'd received, it became apparent it was a scam attempt, the notices looked nothing like what the Client had shown us. The call-floor managers and I marched into the President's office and basically demanded that she drop the Client before we got in serious trouble for Aiding and Abetting. She pushed back, but agreed to loop in her attorney. I saw the President's face after that meeting.... She looked like she'd exsanguinated during the meeting. The Client was sent packing.

Comment Re:For once (Score 1) 175

Not at all true. (West Coast US) From personal experience, the Magistrate will not drop the matter, even when presented with clear evidence that the infraction is invalid. They tend to haggle, reduce the fine, redefine the offense, etc In one case I had the fine reduced from $250 to $1 (one). When I pushed the Magistrate to let go of the conviction, she countered that I could take it up with a Superior Court Judge by demanding a formal trial. A process requiring significant filing fees, and hiring a civil attorney. One dollar was the final offer - take it or leave it.

The Magistrate will not let go of a potential conviction, even if the fine is $1 because that is how a they metamorphose into a Judge. The conviction record is an extremely important component of their career advancement.

Comment Re:This will be quickly squashed. (Score 1) 153

Apple doesn't repair much of anything they make any more in their stores. Most of the "referb" work that is done is handled in bulk from warranty failures sent back to China. The other source of "referb" units are customer returns under warranty. Device was not bad it just didn't meet the customer requirements. Basically, fulfillment errors. These devices are given a quick diagnostic, flash-wipe, etc and repackaged as refurbished units, since they cannot be sold as new.

So what probably happened is some flunky put your iDevice under diagnostics, it failed. They tossed it in the 'To China' bin, and grabbed a used device out of their 'From China' bin.

A commenter below makes a case for replacing the outer plastics, etc during refurbish.... That might work for some models of iDevices, but in most cases the cases don't get replaced because it would require completely remanufacturing the iDevice from used assemblies anyway. So cosmetic defects abound! I'm glad you made them eat it!

Comment Re:Vector? (Score 2) 184

Vector games did not have very high resolution, and did not draw pure 'analog' vectors. Go take a look at the schematic for Asteroids.... There is a pair of line drawing state machines that steer the X-Y position of the beam at a resolution of 1024. Technically, +- 512 because the DAC output is run through a buffer Amp that takes the output of the DAC and centers it around zero. The input to the DAC is treated as a 10-bit signed integer. There is a bit more magic upstream to generate the clock pulse chains that get sent to the position accumulators. They were just drawing lines. If you want the gory details you can read about them here from one of the engineers that worked at Atari on these games: http://www.jmargolin.com/vgens...

Comment Re:Fundamental problem with this project... (Score 1) 172

How is he supposed to KNOW that the bits in the cartridge are correct?

Radiation and high-temperatures still effect ROM memory. Otherwise, why would we need rad-hardened ROM memory on satellites? And what is space? Just a more dangerous version of what we have on Earth--but Earth still has some radiation. Now add DECADES of sitting around absorbing background radiation, with periods of sitting thrown around on top of someone's table under hot sunlight.

There's a reason super-long-term storage is not as simple as burning a CD.

Now, yes, yes, the practical cure of things like boot loaders, ROM hacks, poor early dumps, and all that crap. Sure. I'm clearly NOT debating that. But tiny artifacts in sprites? Single bit changes in code? Maybe not so much...

Bullshit. You have no idea what you are talking about.

Mass manufactured Carts use mask-programmed ROM devices. Such devices are literally hardwired during fabrication with the bit pattern using a metallization layer. EPROMs are only used for Prototypes because compared to Masked-ROMs they are hideously expensive. Masked ROMs don't lose their bits. The only way to get a bit flip there would be from de-capping the device an physically altering the mask. In ROM failures part of the address decode logic or an I/O line are damaged, from over-voltage, or static discharge. That kind of failure would make a Cart completely dead (crash the CPU, or the graphics would be mangled.

Rad-hard ROMs used in high radiation applications have specially designed transistors in the decode logic to prevent reading the wrong word in the array. The array of bits is just a mask of metallization on the die that wires up the 1 or 0 for each bit cell. Those bits will only change if the array is mechanically damaged.

Slashdot Top Deals

Intel CPUs are not defective, they just act that way. -- Henry Spencer

Working...