Follow Slashdot stories on Twitter

 



Forgot your password?
typodupeerror

Comment TL;DR - mitigation here (Score 2, Informative) 231

To mitigate on clients and servers: in /etc/ssh/sshd_config and /etc/ssh/ssh_config and/or any ssh clients you use, add:
Ciphers aes256-ctr,aes192-ctr,aes128-ctr
MACs hmac-sha1

To verify:
ssh -v host
look for the output:
debug1: kex: server->client aes128-ctr hmac-sha1 zlib@openssh.com
debug1: kex: client->server aes128-ctr hmac-sha1 zlib@openssh.com
You are particularly interested in the aesXXX-ctr segment. If that specifies a CBC mode, then you probably need to change that server's config. For the blowfish-using type, I'm uncertain of the attack's applicability to blowfish-cbc. YMMV. For server testing, you probably want to make sure your ssh client isn't forcing the CTR mode. To test that, do
ssh -v -o Ciphers=aes256-cbc,aes192-cbc,aes128-cbc,aes256-ctr,aes192-ctr,aes128-ctr
and look for similar debugging output as above.
Image

Norfolk Police Officers To Be Tagged To Improve Response Times 150

Police in Norfolk, England already have tracking units, The Automatic Vehicle Location System, installed in their cars that allow a control room to track their exact locations. Later this year a similar system will be attached to individual police radios to allow controllers to monitor the position of every frontline officer. Combined with equipment that can pinpoint the locations of 999 callers, the system will allow the force to home in on "shouts" to within yards. The system also lets operators filter a map showing the location of its vehicles and constables to reveal only those with the skills needed for a specific incident, like the closest officer with silver bullets during a werewolf attack.
Patents

Working Toward a Patent-Agnostic Open Source License 124

Glyn Moody writes "Are there ever circumstances when software patents that require payment might be permitted by an open source license? That's the question posed by a new license that is being submitted to the Open Source Initiative (OSI) for review. The MPEG Working Group wants to release a reference implementation of the new MPEG eXtensible Middleware (MXM) standard as open source, but it also wants to be able to sell patent licenses. If it can't, it might not make the implementation open source; but if it does, it might undermine the fight against software patent proliferation."
The Internet

Multiple Fiber Cuts In San Francisco Area 368

georgewilliamherbert writes "Multiple news reports, mailing list posts, blogs, and tweets are pointing out two overnight acts of sabotage in the San Francisco Bay area, with long distance fiber network cables being cut in two locations in the early morning hours. The first cut, around 1:30 AM, affecting landline and cell phone service and 911 calls in the communities of Morgan Hill, Gilroy, and parts of Santa Cruz counties, was on an AT&T fiber alongside Monterey Highway near Blossom Hill Road, in San Jose. A second cut, around 3:30 AM, in San Carlos, affected Sprint fiber and has significantly disrupted services at the 200 Paul datacenter in southern San Francisco. Rumor says that this may be related to a AT&T communications workers contract having just expired — but no evidence has been published yet in the media, and this could be an intentional act of sabotage by someone unrelated to the company's workers."
The Almighty Buck

Economic Crisis Will Eliminate Open Source 753

An anonymous reader writes "The economic crisis will ultimately eliminate open source projects and the 'Web 2.0 free economy,' says Andrew Keen, author of The Cult of the Amateur. Along with the economic downturn and record job loss, he says, we will see the elimination of projects including Wikipedia, CNN's iReport, and much of the blogosphere. Instead of users offering their services 'for free,' he says, we're about to see a 'sharp cultural shift in our attitude toward the economic value of our labor' and a rise of online media businesses that reward their contributors with cash. Companies that will survive, he says, include Hulu, iTunes, and Mahalo. 'The hungry and cold unemployed masses aren't going to continue giving away their intellectual labor on the Internet in the speculative hope that they might get some "back end" revenue,' says Keen."
Communications

Handling Caller ID Spoofing? 556

An anonymous reader writes "A nice little old lady I know has had her number spoofed by some car warranty scammers. They're calling hundreds of potential victims per day pretending to use her phone number, and the angry ones call her back; some of them have even left death threats. She's terrified. Some well-intending anti-telemarketing folks have posted her address on the 'net as well. How can we figure out where these scammer bastards are, and what's the state of the current legislation to prevent caller ID spoofing? I called the FBI in Boston (near where she lives) and they said they can't help. She's called her phone company, but they said they can't help either. She's had the same number for over 50 years and doesn't want to change it." If the Feds can't or won't handle it, what's the best approach here?
Security

New Denial-of-Service Attack Is a Killer 341

ancientribe writes "Hacker RSnake blogs about a newly discovered and deadly denial-of-service attack that could well be the next big threat to the Internet as a whole. It goes after a broadband Internet connection and KOs machines on the other end such that they stay offline even after the attack is over. It spans various systems, too: the pair of Swedish researchers who found it have already contacted firewall, operating system, and Web-enabled device vendors whose products are vulnerable to this attack." Listen to the interview (MP3) — English starts a few minutes in — and you might find yourself convinced that we have a problem. The researchers claim that they have been able to take down every system with a TCP/IP stack that they have attempted; and they know of no fix or workaround.
Image

Russian Town Puts Giant Smiley On Google Maps 280

Toramir writes "Citizens of the Russian town Chelyabinsk calculated when the satellite, QuickBird, which takes images for Google Earth and Google Maps, would cross above their city and used people to make a giant smiley face. A rock concert on the main square attracted many people and everyone got a yellow cape. It looks like someone at Google was quicker than usual to put up the new data. Maybe Google likes the idea of an entire town working hard to get its 15 minutes of fame. The article has a screenshot of Google Maps and images taken directly at the event."

Slashdot Top Deals

Let's organize this thing and take all the fun out of it.

Working...