Virus Information News

  1     2     3     4     5     6     7     8     9     10    | [Next]  [Last] of 172 page(s)

Wild at Heart: Were Intelligence Agencies Using Heartbleed in November 2013?

eff.org

May 6, 2014

Yesterday afternoon, Ars Technica published a story reporting two possible logs of Heartbleed attacks occurring in the wild, months before Monday's public disclosure of the vulnerability.

It would be very bad news if these stories were true, indicating that blackhats and/or intelligence agencies may have had a long period when they knew about the attack and could use it at their leisure. In response to the story, EFF called for further evidence of Heartbleed attacks in the wild prior to Monday. The first thing we learned was that the SeaCat report was a possible false positive; the pattern in their logs looks like it could be caused by ErrataSec's masscan software, and indeed one of the source IPs was ErrataSec.

Schneier on Security: Heartbleed

schneier.com

May 5, 2014

Heartbleed is a catastrophic bug in OpenSSL. Basically, an attacker can grab 64K of memory from a server. The attack leaves no trace, and can be done multiple times to grab a different random 64K of memory.

"Catastrophic" is the right word. On the scale of 1 to 10, this is an 11. Half a million sites are vulnerable, including my own. Test your vulnerability here. The bug has been patched. After you patch your systems, you have to get a new public/private key pair, update your SSL certificate, and then change every password that could potentially be affected. At this point, the probability is close to one that every target has had its private keys extracted by multiple intelligence agencies. The real question is whether or not someone deliberately inserted this bug into OpenSSL, and has had two years of unfettered access to everything. My guess is accident, but I have no proof.

Internet Activist Recovers Deleted Video of Police Assault, This is How We Win!

thefreethoughtproject.com

March 3, 2014

The power of the internet knows no bounds. It is our most powerful weapon against corruption and has helped to shed light on the ones that wish to remain in the darkness.

The story below is another wonderful example of how the internet is helping to exonerate the innocent whilst bringing justice to the corrupt. A man was assaulted by police and his video of the incident confiscated. He was then jailed for 10 days after false charges were brought against him. A year later he received his phone back only to find that the files had been corrupted and the video unplayable. He reached out to the internet, and the internet answered. One of the files was repaired by a reddit user, which shows the assault on video. He explains what happens in the story below.

Selling a Google Chrome Extension is Easy but Monetizing is Tricky

labnol.org

January 18, 2014

When Google decided the pull the plug on Google Reader, I quickly made the switch to Feedly since it was (and still is) the best alternative to Google's RSS Reader.

The one important piece that Feedly did not offer was a Chrome extension that would let users subscribe to RSS feeds on any web page with a click. Since the extension was something that I needed for my own workflow, I wrote one (writing a Chrome extension is easy) and also published it to Google Chrome store. The last time I checked my Chrome developer dashboard, the extension had gained 30000+ users on Chrome.

Get the VPN that protects your privacy and fights NSA spying.

getavpn.org

January 17, 2014

A VPN is the only practical way to stop the NSA from knowing what sites you visit. VPNs will unblock censored websites and block bittorrent lawsuits (along with those annoying copyright warning letters) all for just 10 cents a day.

This VPN installs in minutes, runs in the background, and even works on smartphones. Since the proceeds fund Fight for the Future's activism campaigns, you won't just be protecting yourself, you'll be fighting for a better Internet: one that's free of censorship and spying. A VPN runs silently in the background, sending your entire Internet connection over a secure, encrypted channel. To the outside world, all your traffic comes from a single IP address (in, say, New Jersey... or Switzerland) that thousands of others share.

Schneier on Security: Security Risks of Embedded Systems

schneier.com

January 16, 2014

We're at a crisis point now with regard to the security of embedded systems, where computing is embedded into the hardware itself -- as with the Internet of Things.

These embedded computers are riddled with vulnerabilities, and there's no good way to patch them. It's not unlike what happened in the mid-1990s, when the insecurity of personal computers was reaching crisis levels. Software and operating systems were riddled with security vulnerabilities, and there was no good way to patch them. Companies were trying to keep vulnerabilities secret, and not releasing security updates quickly. And when updates were released, it was hard -- if not impossible -- to get users to install them. This has changed over the past twenty years, due to a combination of full disclosure -- publishing vulnerabilities to force companies to issue patches quicker -- and automatic updates: automating the process of installing updates on users' computers. The results aren't perfect, but they're much better than ever before. But this time the problem is much worse, because the world is different: All of these devices are connected to the Internet. The computers in our routers and modems are much more powerful than the PCs of the mid-1990s, and the Internet of Things will put computers into all sorts of consumer devices. The industries producing these devices are even less capable of fixing the problem than the PC and software industries were.

The Unconventional Way Sen. Rand Paul Is Teaching the Youth About Domestic Surveillance

theblaze.com

January 15, 2014

Sen. Rand Paul (R-Ky.) made headlines Wednesday after joining Snapchat, the popular messaging app that allows users to send photos and videos that self-delete within seconds of being viewed.

"When I chat with people, I want it to disappear, and I don't want the NSA looking at my chats," he explained in an interview with TheBlaze TV's Will Cain. "So I thought, what better way to have my chats disappear than to join Snapchat?" When Cain noted that the NSA could access Snapchat's servers, Paul laughed and said: "Yeah, we kinda realize all of that. Some of this is tongue-in-cheek and lighthearted, but some of it has a more serious purpose, and that is to bring up the discussion of privacy."

US govt attempts to block lawsuit against NSA

RT

January 9, 2014

Lawyers from the Justice Department have urged a judge to halt a lawsuit against the NSA's spy programs. This comes after the judge's previous ruling that the NSA's collection of metadata was likely unconstitutional and "almost Orwellian" in nature.

On Wednesday, government lawyers appealed to US District Court Judge Richard Leon to put court proceedings on hold for two lawsuits against the NSA filed by conservative legal activist, Larry Klayman. Klayman has challenged the legality of the NSA's programs that collect and store the metadata of American citizens on a massive scale. The lawyers argued that if the lawsuits were allowed to go further, they would lead to the disclosure of classified information which would represent a "significant risk" to national security. "Plaintiffs have made clear their intentions to seek discovery of this kind of still-classified information, concerning targets and subjects, participating providers, and other operational details of the challenged NSA intelligence programs," said the motion.

thepatriotnation.net

January 7, 2014

Facebook, the popular social network with over a billion users world wide, has just been hit with a class-action lawsuit.

The allegations, revealed in the FT, are that Facebook systematically scans the content of private messages so it can sell the data to third parties such as advertisers. Facebook's entire business model is based on the fact that it monitors what users write, like and up-load in order to sell this information on to others. I have covered some of the concerns about this in my articles 'How Facebook Exploits Your Private Information' and 'How Facebook Likes Reveal Your Intimate Secrets'. In principle, there is nothing wrong with Facebook using our data to make commercial gains. In the end, the service is free and Facebook has to make money somehow. However, my biggest concern is that the data mining activities are not as transparent as they should be.

Need more reasons to feel paranoid about the NSA? Watch this.

io9.com

January 6, 2014

This is a terrific presentation from tech researcher and journalist Jacob Appelbaum. At December's Chaos Computer Congress in Hamburg, he presented the latest documented revelations about how deep the NSA spying rabbit hole really goes.

Appelbaum timed his talk to come out at the same time as a Der Spiegel article detailing the discovery of an NSA group called TAO, which helps the agency spy on citizens' private computers - even intercepting computer deliveries to add backdoors to targeted people's machines. Working with the German news magazine, Appelbaum carefully explains what he found and how it affects ordinary people around the world. The extreme overzealousness of the NSA's spying programs has been revealed bit by bit in the wake of whistleblower Edward Snowden's revelations last year. Now, even conservative politicians like Republican Sen. Rand Paul are saying that the NSA is going too far. Paul recently threatened to sue the federal government for spying on its own citizens.

  1     2     3     4     5     6     7     8     9     10    | [Next]  [Last] of 172 page(s)