Follow Slashdot stories on Twitter


Forgot your password?
DEAL: For $25 - Add A Second Phone Number To Your Smartphone for life! Use promo code SLASHDOT25. Also, Slashdot's Facebook page has a chat bot now. Message it for stories and more. Check out the new SourceForge HTML5 Internet speed test! ×

Comment Earlier Submission (Score 2) 169

The better story about this vulnerability is the fact that the entire delivery of the malware (from a compromised US foreign policy think tank, no less), was limited to people with the ability to view English (American English), Russian, Japanese and traditional Chinese characters. It's supected of being a 'watering hole' attack. Read more from the earlier submission which didn't include bullshit link bait for advertising dollars.

Comment Typos (Sorry) (Score 1) 2

The security firm FireEye is reporting that a 0Day was used in this attack, & provides some great details on the metadata left by the attacker(s).

FireEye also reports the malware as targeting "...English (U.S.), Chinese (China), Chinese (Taiwan), Japanese, Korean, or Russian," contrary to the Free Beacon's information that the attack was exclusively targeting machines with support for Chinese characters.

Comment Some More Info... (Score 1) 2

that a 0Day was used in this attack, & provides some great details on the metadata left by the attacker(s).

FireEye also reports the malware as targeting "...English (U.S.), Chinese (China), Chinese (Taiwan), Japanese, Korean, or Russian," contrary to the Free Beacon's information that the attack was exclusively targeting machines with support for Chinese characters.

Submission + - Website for the Council on Foreign Relations Compromised 2

deeqkah writes: It has been confirmed by David Mikhail, of spokesperson for The Council on Foreign Relations (CFR) that malware had been installed on CFR's website. The Washington Free Beacon, citing a source apparently familiar with the forensic investigation of this incident (a 'security analyst speaking on the condition of anonymity'), is reporting that a 'drive-by' had been installed on the compromised website as late as Wednesday of this week, and has since been removed. The Washington Free Beacon's source also revealed that the attackers apparently limited their targets to users who's browsers were configured to display characters from the Chinese language, and that the malware itself was allegedly written in Mandarin.

The Council on Foreign Relations is a self described "nonpartisan membership organization, think tank, and publisher" with over four thousand members located across the globe. Some current members include current and former US Government officials (including Presidents), and journalists.

Submission + - Google security engineer issues Sophos warning (

angry tapir writes: "Google security engineer Tavis Ormandy discovered several flaws in Sophos antivirus and says the product should be kept away from high value information systems unless the company can avoid easy mistakes and issue patches faster. Ormandy has released a scathing 30-page analysis (PDF) “Sophail: Applied attacks against Sophos Antivirus”, in which he details several flaws “caused by poor development practices and coding standards”, topped off by the company’s sluggishly response to the warning he had working exploits for those flaws. One of the exploits Ormandy details is for a flaw in Sophos‘ on-access scanner, which could be used to unleash a worm on a network simply by targeting a company receiving an attack email via Outlook. Although the example he provided was on a Mac, the “wormable, pre-authentication, zero-interaction, remote root” affected all platforms running Sophos. (Ormandy released the paper as an independent researcher, not in his role as a Google employee.)"

Submission + - Copyright Alert System Coming Within Weeks (

SternisheFan writes: "A merican Internet users can expect to start seeing notifications from their Internet service providers if they trade files on peer-to-peer networks. A blog post by Jill Lesser, executive director of the Center for Copyright Information, revealed the long-awaited Copyright Alert System (CAS) will begin "in the coming weeks" and provided some details about the partnership with ISPs to deter subscribers from infringement over peer-to-peer networks. ISPs to Roll Out Copyright Alert Systems This Year, CCI's New Executive Director Says In the coming weeks, participating ISPs will launch its version of the CAS. Each system allows content owners to send infringement notices to subscribers via the ISP. When infringing activity continues, CAS will send "enhanced alerts" that vary by ISP but range from a requirement that a subscriber review educational material to temporary throttling of the subscriber's Internet speed. The CCI member companies include the RIAA, the MPAA and five major Internet service providers: Verizon, AT&T, Comcast, Cablevision and Time Warner Cable. Consumers and critics may find some comfort in the steps the CCI has taken to ensure fairness. For starters, unlike anti-piracy efforts in other countries, CAS is not a "strikeout" program that will result in termination of an account. In addition, CCI has retained Stroz Friedberg to ensure MarkMonitor's system for identifying alleged infringement is accurate and works properly. The CAS is the result of a 2011 memorandum of understanding between a group of U.S. Internet service providers, the MPAA and the RIAA that outlined the system for alerting subscribers of their infringing behavior and educating them on alternatives. Lesser was hired as executive director in April. She was previously Deputy Director of Public Policy and Director of the Civic Media Project at the advocacy group People for the American Way."

Submission + - Validating SSL Certs Completely Broken Outside the Browser (

deeqkah writes: SSL Certificate Validation, in a nutshell, attempts to confirm to the user that the identity of the website that he or she is connnecting to is indeed that website, because a "Trusted Authority" said so. While it can be said that Certificate Validation is a bit sketchy in the browser, it can be said with certainty that outside of the browser, the majority of SSL implementations are completely broken.

In a paper submitted to the ACM Conference on Computer & Communications Security [PDF], six researchers from the University of Texas at Austin and Stanford University demonstrate the great lengths of which this SSL implmentation is broken. Most concerning is the fact that the vulnerable applications & libraries are widely used — Amazonâ(TM)s EC2 Java library and all cloud clients based on it, Amazonâ(TM)s and PayPalâ(TM)s merchant SDKs, integrated shopping carts (ZenCart, Ubercart, and PrestaShop), Chase mobile banking and several other Android apps and libraries... the list is of course expansive.

The researches state: "The root causes of these vulnerabilities are badly designed APIs of SSL implementations (such as JSSE, OpenSSL, and GnuTLS) and data-transport libraries (such as cURL) which present developers with a confusing array of settings and options."


Submission + - Carbon clock gets reset (

ananyo writes: "Climate records from a Japanese lake are set to improve the accuracy of carbon dating, which could help to shed light on archaeological mysteries such as why Neanderthals became extinct.
Carbon dating is used to work out the age of organic material. But the technique assumes that the amount of carbon-14 in the atmosphere was constant — any variation would speed up or slow down the clock. Since the 1960s, scientists have started accounting for the variations by calibrating the clock against the known ages of tree rings. The problem is that tree rings provide a direct record that only goes as far back as about 14,000 years.
Now, using sediment from bed of Lake Suigetsu, west of Tokyo, researchers have pushed the calibration limit back much further. Two distinct sediment layers have formed in the lake every summer and winter over tens of thousands of years. The researchers collected roughly 70-metre core samples from the lake and painstakingly counted the layers to come up with a direct record stretching back 52,000 years.
The recalibrated clock could help to narrow the window of key events in human history. Take the extinction of Neanderthals, which occurred in western Europe less than 30,000 years ago. Archaeologists disagree over the effects changing climate and competition from recently arriving humans had on the Neanderthals' demise. The more accurate carbon clock should yield better dates for any overlap of humans and Neanderthals, as well as for determining how climate changes influenced the extinction of Neanderthals."

Slashdot Top Deals

"If you can, help others. If you can't, at least don't hurt others." -- the Dalai Lama