Become a fan of Slashdot on Facebook

 



Forgot your password?
typodupeerror

Submission + - Silicon Valley Is the World's Innovation Capital Because of a Legal Technicality

HughPickens.com writes: Natalie Kitroeff writes at Bloomberg that a new study says the secret to Silicon Valley’s triumph as the global capital of innovation may lie in a quirk of California’s employment law that prohibits the legal enforcement of non-compete clauses. Unlike most states, California prohibits enforcement of non-compete clauses that force people who leave jobs to wait for a predetermined period before taking positions at rival companies. That puts California in the ideal position to rob other regions of their most prized inventors, “Policymakers who sanction the use of non-competes could be inadvertently creating regional disadvantage as far as retention of knowledge workers is concerned,” wrote the authors of the study "Regional disadvantage? Employee non-compete agreements and brain drain" (PDF). "Regions that choose to enforce employee non-compete agreements may therefore be subjecting themselves to a domestic brain drain not unlike that described in the literature on international emigration out of less developed countries."

The study, which looked at the behavior of people who had registered at least two patents from 1975 to 2005, focused on Michigan, which in 1985 reversed its longstanding prohibition of non-compete agreements. The authors found that after Michigan changed the rules, the rate of emigration among inventors was twice as a high as it was in states where non-competes remained illegal. Even worse for Michigan, its most talented inventors were also the most likely to flee. "Firms are going to be willing to relocate someone who is really good, as opposed to someone who is average," says Lee Fleming. For the inventors, it makes sense to take a risk on a place such as California, where they have more freedom. "If the job they relocate for doesn’t work out, then they can walk across the street because there are no non-competes

Submission + - Windows 10's Biometric Security Layer Introduced

jones_supa writes: One of the major concepts of Windows 10 are new security ideas, and though Microsoft has touched on this topic before, it's only now giving us a more comprehensive look in the form of "Windows Hello". This is an authentication system that uses a variety of biometric signatures and combines hardware and software to allow for seamless and secure user recognition and sign-in. According to Microsoft, the ideal scenario here would be for you to simply look or touch a new device running Windows 10 and to be immediately signed up. The software analyzes input from such hardware as fingerprint scanners and infrared sensors to make sure that you are you and not some imposter, and then signs you in without requiring you to enter a password. But the point of Windows Hello isn't only convenience, as the company's blog post notes, but also security. We've heard time and time again how insecure passwords are, and Microsoft is aiming to offer a widely-deployed replacement while still delivering enterprise grade security and privacy.

Submission + - Incomplete Microsoft Patch Left Machines Exposed to Stuxnet LNK Vulnerability (threatpost.com)

msm1267 writes: A five-year-old Microsoft patch for the .LNK vulnerability exploited by Stuxnet failed to properly protect Windows machines, leaving them exposed to exploits since 2010.

Microsoft today is expected to release a security bulletin, MS15-020, patching the vulnerability (CVE-2015-0096). It is unknown whether there have been public exploits of patched machines. The original LNK patch was released Aug. 2, 2010.

“That patch didn’t completely address the .LNK issue in the Windows shell, and there were weaknesses left behind that have been resolved in this patch,” said Brian Gorenc, manager of vulnerability research with HP's Zero Day Initiative. Gorenc said the vulnerability works on Windows machines going back to Windows XP through Windows 8.1, and the proof of concept exploit developed by Heerklotz and tweaked by ZDI evades the validation checks put in place by the original Microsoft security bulletin, CVE-2010-2568.

The vulnerability was submitted to ZDI by German researcher Michael Heerklotz.

Submission + - National Security Letter Issuance Likely Headed to Supreme Court (threatpost.com)

Gunkerty Jeb writes: The Ninth Circuit appeals court in San Francisco took oral arguments from the Electronic Frontier Foundation and the Department of Justice yesterday over the constitutionality of National Security Letters and the gag orders associated with them. The EFF defended a lower court's ruling that NSLs are unconstitutional, while the DoJ defended a separate ruling that NSLs can be enforced. Whatever the court rules, the issue of NSLs is all but certainly headed for the Supreme Court in the not too distant future.

Submission + - Verizon Transparency Report: Govt Requests Increasing (threatpost.com)

Gunkerty Jeb writes: After months of public calls from privacy advocates and security experts, Verizon on Wednesday released its first transparency report, revealing that it received more than 164,000 subpoenas and between 1,000 and 2,000 National Security Letters in 2013. The report, which covers Verizon’s landline, Internet and wireless services, shows that the company also received 36,000 warrants, most of which requested location or stored content data.

Submission + - Kelihos Relying on CBL Blacklists to Evaluate New Bots (threatpost.com)

Gunkerty Jeb writes: Kelihos, the peer-to-peer botnet with nine lives, keeps popping up with new capabilities that enable it to sustain itself and make money for its keepers by pushing spam, harvesting credentials and even stealing Bitcoins.

According to a number of sources, Kelihos is now leveraging legitimate and freely available security services that manage composite blocking lists (CBLs) to determine if a potential victim’s IP address has previously been flagged as a spam source or as a proxy. A CBL is a blacklist of IP addresses known to be participating in spreading spam or malware.

Submission + - College Student Gets Year in Prison for Election Fraud (threatpost.com)

Gunkerty Jeb writes: A former Cal State San Marcos student was sentenced to a year in prison this week for election tampering by using keystroke loggers to grab student credentials and then vote for himself.

Matthew Weaver, 22, of Huntington Beach, Calif., stole almost 750 students’ identities to try and become president of the San Diego County college’s student government. His plan went awry when the school’s computer technicians noticed an anomaly in activity and caught Weaver with keystroke loggers as he sat in front of the suspicious computer.

Submission + - DNI James Clapper Admits He Lied To Congress (threatpost.com)

Gunkerty Jeb writes: In a highly unusual move, James Clapper, the director of national intelligence, said Tuesday that he misspoke when he told a Congressional committee in March that the National Security Agency does not assemble dossiers on Americans. Clapper said at the time that the agency does not do so “wittingly”, but in a letter to the chair of the Senate Select Committee on Intelligence, Clapper admitted this statement was “erroneous”.

Clapper, the top U.S. intelligence official, has been quite vocal in his defense of the NSA’s now-public surveillance programs such as PRISM and the metadata collection program. In statements published shortly after the leak of classified documents by Edward Snowden about those collection efforts Clapper said that they both have been repeatedly authorized by Congress and the executive and judicial branches over the years. The collection of road swaths of Internet data under Section 702 of the Foreign Intelligence Surveillance Act through PRISM is one of the aspects of the agency’s efforts that has many people worried.

Submission + - Flaws in ZRTPCPP Library Used in Secure Phone Apps (threatpost.com)

Gunkerty Jeb writes: A security researcher has uncovered a number of serious vulnerabilities in one of the core security components of several secure telephony applications, including the Silent Circle system developed by PGP creator Phil Zimmermann. The vulnerabilities in the GNU ZRTPCPP library already have been addressed in a new version of the library and Silent Circle has implemented a fix, as well.

ZRTPCPP is a library that implements the ZRTP protocol that Zimmermann and others developed to establish secure sessions over a pre-existing connection. Silent Circle, which sells a cryptographically secure mobile phone application, and several other products implement the ZRTPCPP library, and Mark Dowd of Azimuth Security has identified several vulnerabilities in the library that could give an attacker the ability to get remote code execution. Dowd said that the bugs can be exploited by remote, unauthenticated users.

Submission + - Cylance Hacks Google Office Building Management System (threatpost.com)

Gunkerty Jeb writes: Industrial control minded researchers from the security firm Cylance launched a custom exploit against a building management system deployed at Google’s Sydney, Australia office, gaining access to a configuration file containing device administration passwords that could be used to gain complete control of the device in question.

This vulnerability in Tridium’s Niagara framework affects an unknown number of organizations aside from Google. In fact, Tridium claims on its website that “there are over 245,000 instances of the Niagara Framework deployed worldwide.” Cylance said its scans revealed some 25,000 similarly vulnerable systems facing the Internet.

Submission + - Activists Bring Security to the Oppressed (threatpost.com)

msm1267 writes: Tibetans inside China or in exile, along with Syrians, Iranians and other groups oppressed by autocratic regimes, rely on technology to communicate and organize protests. Yet state-sponsored attackers have infiltrated the devices and platforms used by the oppressed to put their freedom or lives in danger. Groups such as Tibet in Action or Citizen Lab Munk School of Global Affairs have put together resources to help educate and enhance the security of oppressed people.

Submission + - Google Privacy Director Alma Whitten Leaving (threatpost.com)

Gunkerty Jeb writes: Alma Whitten, the director of privacy at Google, is stepping down from that role and leaves behind her a complicated legacy in regards to user privacy. Whitten has been the company's top product and engineering privacy official since 2010 and was at the helm as the company navigated a number of serious privacy scandals and controversies.

Whitten has been at Google for about 10 years, and while she has been the main public face of the company's product privacy efforts in the last couple of years, she has been involved in engineering privacy initiatives for even longer. Before becoming the privacy lead for products and engineering in 2010 in the aftermath of the Google Street View WiFi controversy, Whitten had been in charge of privacy for the company's engineering teams. During that time, she was involved in the company's public effort to fight the idea that IP addresses can be considered personally identifiable information.

Security

Submission + - The Malware Industrial Complex (technologyreview.com) 1

holy_calamity writes: "MIT Technology Review reports that efforts by U.S. government agencies and defense contractors to develop malware to attack enemies is driving a black market in zero-day vulnerabilities. Experts warn that could make the internet less secure for everyone, since malicious code is typically left behind on targeted systems and often shows up on untargeted ones, providing opportunities for reverse engineering."
Security

Submission + - 50 Million Potentially Vulnerable to UPnP Flaws (threatpost.com)

Gunkerty Jeb writes: In a project that found more than 80 million unique IP addresses responding to Universal Plug and Play (UPnP) discovery requests, researchers at Rapid7 were shocked to find that somewhere between 40 and 50 million of those are vulnerable to at least one of three known attacks.

A Rapid7 white paper enumerated UPnP-exposed systems connected to the Internet and identified the number of vulnerabilities present in common configurations. Researchers found that more than 6,900 product models produced by 1,500 different vendors contained at least one known vulnerability, with 23 million systems housing the same remote code execution flaw.

"This research was primarily focused on vulnerabilities in the SSDP processor across embedded devices," Rapid7' CSO HD Moore told Threatpost. "The general process was to identify what was out there, make a list of the most commonly used software stacks, and then audit those stacks for vulnerabilities. The results were much worse than we anticipated, with the most commonly used software stack (libupnp) also being the most vulnerable."

Slashdot Top Deals

"But this one goes to eleven." -- Nigel Tufnel

Working...