Become a fan of Slashdot on Facebook

 


Forgot your password?
Close
typodupeerror

Submission + - Florida teen charged with felony hacking for using password teacher gave him (networkworld.com) 2

Submitted by colinneagle
colinneagle writes: A 14-year-old middle school student in Holiday, Florida, was arrested this week and charged with "an offense against a computer system and unauthorized access," which is a felony. The student reportedly used an administrator password to log into a teacher's computer and change the background image to a photo of two men kissing.

The student also revealed his secrets after he was caught – the password was the teacher's last name, and the teacher had typed it in in full view of the students. The student said many other students used these administrators' passwords (their teachers' last names) so they can screen-share and video chat with other students.

The student was briefly held in a nearby detention center, and the county Sheriff warned that other teenagers caught doing the same thing will "face the same consequences."

Submission + - Domain autority ICANN asks FTC to rule on .sucks concern as it lacks authority (v3.co.uk)

Submitted by DW100
DW100 writes: ICANN, the body in charge with overseeing the management and rollout of new top level domains such as .porn, .adult and .sucks, has asked the FTC to investigate whether the registry running .sucks is acting illegally, after concerns raised by ICANN's own in-house legal team it is selling the domains to brand owners in a 'predatory' manner.

Submission + - Watch DARPA Artificial Intelligence Search For Crime On The 'Dark Web' (forbes.com)

Submitted by Anonymous Coward
An anonymous reader writes: The Memex technology, named after an mechanical mnemonic dreamt up just as the Second World War was coming to a close, has already been put to use by a number of law enforcement agencies, who are looking to counter crime taking place on networks like Tor, where Hidden Services are protected by the privacy-enhancing, encrypted hosting, often for good, often for bad. In its first year, the focus at Memex has been on tracking human trafficking, but the project’s scope stretches considerably wider.

Comment Re:Sounds like Acunetix (Score 2) 57

by punk2176 (#44533003) Attached to: DEF CON Hackers Unveil a New Way of Visualizing Web Vulnerabilities
Ask and you shall receive :-). I have more information on that than you'd probably like to know. The back-end is actually quite similar to the PunkSPIDER project's back-end and uses all of the same principles, most of the same open software as its base, and even reuses some of the code (in fact, once it's done I'll probably make the back-end of web 3.0 a part of PunkSPIDER 2.0 - free and open source of course). So with that said here's info on how PunkSPIDER was built, which should give you a solid start to how we're building the web 3.0 back-end:

(1) A link to the talk at ShmooCon on PunkSPIDER which gives more info than you'd ever want to know about the back-end: http://www.hyperiongray.com/shmoocon
(2) If you're in a rush you can read some basic stuff about it here: http://www.hyperiongray.com/node/18
(3) If you really want to get into it you can download PunkSCAN (the PunkSPIDER back-end) on bitbucket and take a look: https://bitbucket.org/punkspider/punkscan

And last but not least, if you want to know even more feel free to contact Hyperion Gray at punkspider@hyperiongray.com or follow me (Alejandro) at @DotSlashPunk on Twitter. Oh and thanks for the feedback on the buzzy name, it's meant to be a little over the top, but we'll keep your comment in mind!

Alex

Submission + - Hackers Unveil A New Way of Visualizing Web Vulnerabilities at DEF CON 21

Submitted by punk2176
punk2176 writes: Hacker and security researcher Alejandro Caceres (developer of the PunkSPIDER project) and 3D UI developer Teal Rogers unveiled a new free and open source tool at DEF CON 21 that could change the way that users view the web and its vulnerabilities. The project is a visualization system that combines the principles of offensive security, 3D data visualization, and "big data" to allow users to understand the complex interconnections between websites. Using a highly distributed HBase back-end and a Hadoop-based vulnerability scanner and web crawler the project is meant to improve the average user's understanding of the unseen and potentially vulnerable underbelly of web applications that they own or use. The makers are calling this new method of visualization web 3.0.

A free demo can be found here, where users can play with and navigate an early version of the tool via a web interface. More details can be found here and interested users can opt-in to the mailing list and eventually the closed beta here.

Submission + - NVIDIA open sources SHIELD's operating system (paritynews.com)

Submitted by hypnosec
hypnosec writes: NVidia has now open-sourced the operating system that powers the gaming console to encourage its modification and further development. Powered by NVidia’s homegrown Tegra 4 processor, the console runs Android, which shouldn't surprise many as the company moves ahead with its opensourcing intentions. The GPU company has said that the SHIELD is an ‘open gaming platform’ that allows for ‘an open ecosystem’ enabling developers to develop content as well as applications that takes advantage of the underlying hardware and which can be enjoyed on bigger displays as well as mobile screen.

Submission + - Stop fixing all security vulnerabilities. (blog.risk.io)

Submitted by PMcGovern
PMcGovern writes: At BSidesLV in Las Vegas, Ed Bellis and Data Scientist Michael Roytman gave a talk explaining how security vulnerability statistics should be done. " Don't fix all security issues. Fix the security issues that matter, based on statistical relevance." They looked at 23,000,000 live vulnerabilities across 1,000,000 real assets, which belonged to 9,500 clients to explain their thesis.

Submission + - Elon Musk Admits he is Too Busy to Build Hyperloop (ibtimes.co.uk)

Submitted by DavidGilbert99
DavidGilbert99 writes: It sounded like the future — a 600mph train taking people from San Francisco to Los Angeles in just 30mins. In fact it sounded like a future too good to be true. And so it seems to have proven. As Alistair Charlton at IBTimes reports, Elon Musk, the man behind PayPal, Tesla and Space X has admitted that Hyperloop is a step too far and he should never have mentioned it in the first place — "I think I shot myself in the foot by ever mentioning the Hyperloop. I'm too strung out." Oh well, let's hope SpaceX works out a bit better.....

Comment Re:Ethics (Score 2, Informative) 85

by punk2176 (#42994233) Attached to: PunkSPIDER Project Puts Vulnerabilities On (Searchable) Display
Hmm, a few issues with this...

1) The statement that we "just run Nessus" is incorrect. We wrote our own scanner that works on a Hadoop cluster. Why is this important? It means that we can handle a lot more scans than anyone else (several thousand per day with a small cluster) and it's also specifically made for mass scans. This is important in point 2 below.

2) The process you're describing is for finding a vulnerability in a piece of software in general (e.g. a common CMS), not a specific vulnerability in an implementation of a piece of software (e.g. a specific website). That's a huge difference. You wouldn't put a CVE up for a SQL injection bug in a specific implementation of a site (you would only if it was common to an entire CMS for example). Anyway, what we hope is to build a community of like-minded security folks that can help those website owners fix their *specific issues* first and if applicable go through the process you describe when needed. We also want to provide this for free.

3) What if the vulnerability is in a custom built site that no one cares enough about to do security research on. Who's letting them know their issues? We hope to provide a view of this to the website owner and yes, push them a little to get their security ducks in a row.

4) We're not attention whores or jackasses. Calling people names isn't nice and makes us sad.

Comment Re:Couldn't find any - the results so far ARE pret (Score 3, Informative) 85

by punk2176 (#42994109) Attached to: PunkSPIDER Project Puts Vulnerabilities On (Searchable) Display
So one thing that we've been trying to make clear is that the project is *on track* to scan the entire Internet, we haven't scanned everything yet. We have scanned about 70k sites and have under 4 million indexed. Our next version is going to be clearer on what is and is not scanned - currently we just say 0 vulnerabilities if we haven't scanned it, indicating that we have not found vulnerabilities in it yet - not necessarily that it doesn't have any. This was all part of our ShmooCon presentation which just hasn't been released to everyone yet! The system is self-sustaining at this point so these numbers are constantly going up. The "not pretty" comes from the fact that we have over 100,000 vulnerabilities from just scanning about 70,000 sites (some sites have multiple vulnerabilities).
Security

Submission + - The PunkSPIDER Project Controversy (theregister.co.uk) 1

Submitted by
punk2176
punk2176 writes: "Recently I started a free and open source project known as the PunkSPIDER project and presented it at ShmooCon 2013. If you haven't heard of it, it's at heart, a project with the goal of pushing for improved global website security. In order to do this we built a Hadoop distributed computing cluster along with a website vulneraility scanner that can use the cluster. Once we finished that we open sourced the code to our scanner and unleashed it on the Internet. The results of our scans are provided to the public for free in an easy-to-use search engine. The results so far aren't pretty.

In short after having found tons of vulnerabilities, we've been blowing up. Social media users either love or hate us. Critics have been claiming that the results of our scans can be used for evil by script kiddies. We argue that these results will, more importantly, be used by website owners to check the security of their own websites or website users to check the security of sites to which they entrust their sensitive data. Due to the controversy around the project The Register asked us for our response and published an article about it. I'm curious to see what the Slashdot community thinks — do you think we are doing the right thing?"

Submission + - Source code for Photoshop 1.0 (computerhistory.org)

Submitted by
gbooch
gbooch writes: "With the permission of Adobe Systems, the Computer History Museum has made available the source code for Photoshop version 1.0.1, comprising about 128,000 lines code within 179 files, most of which is in Pascal, the remainder in 68000 assembly language.

This the kind of code I aspire to write.

The Computer History Museum has earlier made available the source code to MacPaint (which you'll find here http://www.computerhistory.org/atchm/macpaint-and-quickdraw-source-code/)."

Slashdot Top Deals

Another megabytes the dust.

Close