KevLar's Space

my little space on the interwebs

The Executive Order That Led To Mass Spying, As Told By NSA Alumni

An anonymous reader writes with this Ars piece about the executive order that is the legal basis for the U.S. government’s mass spying on citizens. One thing sits at the heart of what many consider a surveillance state within the US today. The problem does not begin with political systems that discourage transparency or technologies that can intercept everyday communications without notice. Like everything else in Washington, there’s a legal basis for what many believe is extreme government overreach—in this case, it’s Executive Order 12333, issued in 1981. “12333 is used to target foreigners abroad, and collection happens outside the US,” whistleblower John Tye, a former State Department official, told Ars recently. “My complaint is not that they’re using it to target Americans, my complaint is that the volume of incidental collection on US persons is unconstitutional.” The document, known in government circles as “twelve triple three,” gives incredible leeway to intelligence agencies sweeping up vast quantities of Americans’ data. That data ranges from e-mail content to Facebook messages, from Skype chats to practically anything that passes over the Internet on an incidental basis. In other words, EO 12333 protects the tangential collection of Americans’ data even when Americans aren’t specifically targeted—otherwise it would be forbidden under the Foreign Intelligence Surveillance Act (FISA) of 1978.

Read more of this story at Slashdot.



via Slashdot: IT http://ift.tt/1sLrLsy

PHP 5.6.0 Released

An anonymous reader writes “The PHP team has announced the release of PHP 5.6.0. New features include constant scalar expressions, exponentiation using the ** operator, function and constant importing with the use keyword, support for file uploads larger than 2 GB, and phpdbg as an interactive integrated debugger SAPI. The team also notes important changes affecting compatibility. For example: “Array keys won’t be overwritten when defining an array as a property of a class via an array literal,” json_decode() is now more strict at parsing JSON syntax, and GMP resources are now objects. Here is the migration guide, the full change log, and the downloads page.”

Read more of this story at Slashdot.



via Slashdot: IT http://ift.tt/1mYOT3L

FBI Investigates ‘Sophisticated’ Cyber Attack On JP Morgan, 4 More US Banks

Bruce66423 writes with news of an electronic attack believed to affect at least five U.S. banking institutions this month, including JP Morgan, now being investigated by the FBI. According to the Independent, The attack on JP Morgan reportedly resulted in the loss of “gigabytes of sensitive data” that could have involved customer and employee information. It is said to have been of a level of sophistication beyond ordinary criminals, leading to speculation of a state link. The FBI is thought to be investigating whether there is a connection to Russia. American-Russian relations continue to be fraught amid the crisis in Ukraine, with sanctions ramped up. Bruce66423 asks “The quality of the attack, which appears to have led to ‘gigabytes’ of data being lost, is raising the prospect of a state being the source. The present culprit suggested is Russia… why the assumption it’s not China — just because China isn’t invading the Ukraine at the moment?” News of the attack is also at the New York Times, which notes Earlier this year, iSight Partners, a security firm in Dallas that provides intelligence on online threats, warned companies that they should be prepared for cyberattacks from Russia in retaliation for Western economic sanctions. But Adam Meyers, the head of threat intelligence at CrowdStrike, a security firm that works with banks, said that it would be “premature” to suggest the attacks were motivated by sanctions.

Read more of this story at Slashdot.



via Slashdot: IT http://ift.tt/1zKtQHG

Netflix Open Sources Internal Threat Monitoring Tools

alphadogg (971356) writes Netflix has released three internal tools it uses to catch hints on the Web that hackers might target its services. “Many security teams need to stay on the lookout for Internet-based discussions, posts and other bits that may be of impact to the organizations they are protecting,” wrote Andy Hoernecke and Scott Behrens of Netflix’s Cloud Security Team. One of the tools, called Scumblr, can be used to create custom searches of Google sites, Twitter and Facebook for users or keywords.

Read more of this story at Slashdot.



via Slashdot: IT http://ift.tt/1pjDcKl

Chromium 37 Launches With Major Security Fixes, 64-bit Windows Support

An anonymous reader writes Google has released Chrome/Chromium version 37 for Windows, Mac, and Linux. Among the changes are better-looking fonts on Windows and a revamped password manager. There are 50 security fixes, including several to patch a sandbox escaping vulnerability. The release also brings stable 64-bit Windows support which …offers many benefits for speed, stability and security. Our measurements have shown that the native 64-bit version of Chrome has improved speed on many of our graphics and media benchmarks. For example, the VP9 codec that’s used in High Definition YouTube videos shows a 15% improvement in decoding performance. Stability measurements from people opted into our Canary, Dev and Beta 64-bit channels confirm that 64-bit rendering engines are almost twice as stable as 32-bit engines when handling typical web content. Finally, on 64-bit, our defense in depth security mitigations such as Partition Alloc are able to far more effectively defend against vulnerabilities that rely on controlling the memory layout of objects. The full changelog.

Read more of this story at Slashdot.



via Slashdot: IT http://ift.tt/XSmhmZ

UK Prisons Ministry Fined For Lack of Encryption At Prisons

Bruce66423 (1678196) writes The Guardian reports that the UK Information Commissioner has levied a fine of £180,000 on the Ministry of Justice for their failure to encrypt data held on external hard drives at prisons. The fine is nominal — one part of government fining another is rather pointless, but it does show that there’s a little bit of accountability. Of course it’s interesting to consider the dangers of this hopefully old way of storing backups; but the question of whether we do a lot better now is quite pointed. To make matters worse, one of the unencrypted backup hard drives walked away.

Read more of this story at Slashdot.



via Slashdot: IT http://ift.tt/1pFgxaJ

Project Zero Exploits ‘Unexploitable’ Glibc Bug

NotInHere (3654617) writes with news that Google’s Project Zero has been busy at work. A month ago they reported an off-by-one error in glibc that would overwrite a word on the heap with NUL and were met with skepticism at its ability to be used in an attack. Google’s ‘Project Zero’ devised an exploit of the out-of-bounds NUL write in glibc to gain root access using the setuid binary pkexec in order to convince skeptical glibc developers. 44 days after being reported, the bug has been fixed. They even managed to defeat address space randomization on 32-bit platforms by tweaking ulimits. 64-bit systems should remain safe if they are using address space randomization.

Read more of this story at Slashdot.


via Slashdot: IT http://ift.tt/1vOFAsn

Project Zero Explots ‘Unexploitable’ Glibc Bug

NotInHere (3654617) writes with news that Google’s Project Zero has been busy at work. A month ago they reported an off-by-one error in glibc that would overwrite a word on the heap with NUL and were met with skepticism at its ability to be used in an attack. Google’s ‘Project Zero’ devised an exploit of the out-of-bounds NUL write in glibc to gain root access using the setuid binary pkexec in order to convince skeptical glibc developers. 44 days after being reported, the bug has been fixed. They even managed to defeat address space randomization on 32-bit platforms by tweaking ulimits. 64-bit systems should remain safe if they are using address space randomization.

Read more of this story at Slashdot.



via Slashdot: IT http://ift.tt/1C0mK66

VMware Unveils Workplace Suite and NVIDIA Partnership For Chromebooks

Gamoid writes At VMworld today, VMware introduced the Workplace Suite, a platform for securely delivering applications and content across desktops and mobile devices from the cloud. The really cool part, though, is a partnership with Google and NVIDIA to deliver even graphics-intensive Windows applications on a Chromebook. From the article: “The new VMware Workplace Suite takes advantage of three existing VMware products: Tools for application, device, and content management as well as secure cloud file storage that comes from the January acquisition of enterprise mobile management company AirWatch; VMware Horizon for desktop-as-a-service; and brand-new acquisition CloudVolumes for app delivery. ”

Read more of this story at Slashdot.



via Slashdot: IT http://ift.tt/1qqwMrQ

TechCentral Scams Call Center Scammers

An anonymous reader writes “At TechCentral, we get on average called at least once a week — sometimes far more often — by a friendly sounding Indian national warning us that our Windows computer is infected with a virus. The call, which originates from a call centre, follows exactly the same script every time. Usually we shrug them off and put the phone down, but this week we thought we’d humour them to find out how they operate. As this week’s call came in, the first thing the “operator” at the other end of the line tried to establish was who was owner of the Windows computer in the household. I’d taken the call. It was time to have some fun. I told the scammer that I was the PC owner. He proceeded to introduce himself as “John Connor.” I laughed quietly as I imagined Arnold Schwarzenegger’s Terminator hunting down this scamster in the streets of Calcutta. Perhaps he should have come up with a more convincing name.”

Read more of this story at Slashdot.



via Slashdot: IT http://ift.tt/1zzvo7y

Follow

Get every new post delivered to your Inbox.