Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
Security

Submission + - Mozilla to protect Adobe Flash users (h-online.com) 1

Submitted by
juct
juct writes: "Firefox is going to check the version of installed Adobes Flash plug-ins and warn users if it discovers an outdated version with potential security holes. Mozilla confirmed this new security feature and said that the Flash version check was part of a wider commitment to "protect users from emerging threats online". Only recently a study confirmed, that 80 per cent of users surf with a vulnerable version of Adobe's plug-in."
Security

Submission + - Secure USB sticks cracked (heise-online.co.uk) 1

Submitted by
juct
juct writes: "Manufacturers of USB sticks and cards with fingerprint readers promise us that their data safes can only be opened with the right fingerprint. In their tests, heise Security found that it is easy to bypass the authentication and get access to the protected data. This works by sending a single USB command — Command Descriptor Block — that changed the accessible partition. They found the vulnerability in the MyFlash FP1 from A-Data (USB-ID 1307:1169) and the 1GB Secure Card (USB-ID 7009:1765) sold by 9pay. The JetFlash 210 and 220 fingerprint sticks from Transcend use the chips in question and also provide access to the protected partition after transmission of a single USB command. The UT176 made by CySecure could also suffer from the same flaw, though they have not tested it yet."
Security

Submission + - Cracking a crypto hard drive case (heise-online.co.uk)

Submitted by
juct
juct writes: "An AES label alone does not ensure that your data are protected. heise examined a hard drive enclosure with an RFID key that is quite typical for lots of similar products. They found that the 128-bit AES hardware encryption claimed in adverts, was in fact a simple XOR encryption that they were able to break easily with a known plaintext attack. (Editors: resubmitted with correct links this time — sorry for the one I screwed up)"
Security

Submission + - Antivirus protection worse than a year ago (heise-security.co.uk)

Submitted by
juct
juct writes: "In a test of 17 antivirus products, the german magazine c't concluded, that the effectiveness has fallen off, and more and more pests can now slip past these barriers. Most of the products perform reasonably well if they can rely on their database of signatures. But if they have to detect new malware with heuristics, the results were worse than last year. Besides this c't did the first comprehensive test of behaviour blocking in antivirus products and found that more than half of them did not react on suspicious behaviour at all. The test itself is available only in the printed magazine, heise Security published a summary."
Security

Submission + - Spying on the TOR anonymisation network (heise-security.co.uk)

Submitted by
juct
juct writes: "The long standing suspicion, that the anonymizing network TOR is (ab)used to catch sensitive data by Chinese, Russian and American government agencies as well as hacking groups gets new support. Members of the Teamfurry community found TOR exit-nodes which only forward unencrypted versions of certain protocols. These peculiar configurations invite speculation as to why they are set up in this way. Another tor exit node has been caught doing MITM attacks using fake SSL certificates."
Security

Submission + - OS X Leopard firewall flawed 1

Submitted by cycoj
cycoj writes: German IT magazine Heise takes a look at the new OS X Leopard firewall. They find it flawed. When setting access to specific services and programs for example to only allow SSH access, they found that a manually started service was still accessible. From the article:

"So the first step after starting Leopard should be to activate the firewall. The obvious choice to do so is the option to "Set access to specific services and programs", which promises more control over network traffic. Mac OS X automatically enters all shared resources set up by the user, such as "Remote login" for SSH servers, into the list of accessable resources.

However, initial functional testing quickly dispels any feeling of improved security. A service started for testing purposes was able to be addressed from outside without any difficulty. The firewall records this occurrence."

Even with the firewall set to "Block all incoming connections" ports to netbios, ntp and other services were still open.

"Specifically these results mean that users can't rely on the firewall. Even if users select "Block all incoming connections," potential attackers can continue to communicate with system services such as the time server and possibly with the NetBIOS name server."
Security

Submission + - Unofficial URI-patch for Windows (heise-security.co.uk)

Submitted by dg2fer
dg2fer writes: For more than two month, the vulnerability of parsing URIs is known for several Windows programms, including Outlook, Adobe Reader, IRC clients and many more.

The latest Microsoft patches published for October did not include a solution for the URI problem, so according to an article on heise security hackers started to solve the problem theirselfes and published an unofficial patch which cleans up the critical parameters of URI system calls before calling the vulnerable Windows system function.
Mozilla

Submission + - The Morality of Web Advertisement Blocking (cnet.com) 1

Submitted by Anonymous Coward
An anonymous reader writes: There has been some recent coverage of the over-hyped boycott of Firefox, in response to the rising popularity of the Adblock Plus Firefox extension. A recent editorial on CNET looks into the issue, and explores the moral and legal issues involved in client-side web advertisement blocking. Whereas TiVo users freeload on the relatively fixed broadcasting costs paid by TV networks, users of web ad-blocking technology are actively denying website owners revenue that would otherwise go to pay for the bandwidth costs of serving up those web pages. If the website designer has to pay for bits each time you view their website without viewing their banner ads, are you engaged in theft? Is this right? CNET has more on the subject....

Slashdot Top Deals

On a paper submitted by a physicist colleague: "This isn't right. This isn't even wrong." -- Wolfgang Pauli

Close