GitHub Survived the Biggest DDoS Attack Ever Recorded

Found on Wired on Thursday, 01 March 2018
Browse Internet

On Wednesday, at about 12:15pm ET, 1.35 terabits per second of traffic hit the developer platform GitHub all at once.

Within 10 minutes it had automatically called for help from its DDoS mitigation service, Akamai Prolexic. Prolexic took over as an intermediary, routing all the traffic coming into and out of GitHub, and sent the data through its scrubbing centers to weed out and block malicious packets. After eight minutes, attackers relented and the assault dropped off.

Now why someone would attack GitHub is a question that remainds to be answered. For just a few minutes of downtime the attacker only underlined the importance of secured systems.

Attackers Using Memcached Servers to Amplify DDoS Attacks

Found on eWEEK on Wednesday, 28 February 2018
Browse Internet

Akamai reported that it has seen multiple sets of memcached reflection attacks, with some that were approximately 190 Gbps of attack traffic. Arbor Networks reported that it is seeing memcached attacks that are even larger.

There are several things that can be done to help mitigate the risk of memcached reflection attacks. The most obvious thing that should be done is for organizations to not expose their memcached services to the public internet.

Why on earth would someone with a sane mind expose such services to the entire Internet? That's like opening up a database like MongoDB... Oh wait, nevermind.

Use of HTTPS among top sites is growing, but weirdly so is deprecated HTTP public key pinning

Found on The Register on Tuesday, 27 February 2018
Browse Internet

"The most surprising thing is probably the string growth in HPKP [HTTP public key pinning], a technology being abandoned by many and soon Google Chrome too," Helme told El Reg.

Experts including Helme and Ivan Ristic have criticised the technology as being both tricky to apply and potentially calamitous, if incorrectly set up.

HPKP has always been a risky and very dangerous idea that should not have made it past a concept status. Most likely, those so-called webmasters are faced with requests for more security and just use some copy&paste code from random howto-pages to implement what they consider an important feature without understanding it's possible consequences.

Mozilla removes individual cookie management in Firefox 60

Found on GHacks on Monday, 26 February 2018
Browse Software

While the new interface looks great, you may notice that it is no longer possible to list or remove individual cookies from Firefox using it.

This is bad for users who want full control over cookies. While it is possible that Mozilla will implement the removed functionality before Firefox 60 hits the stable channel, Firefox users may use extensions to restore the functionality.

Mozilla is working hard to turn Firefox into the most useless browser. As per their "UI concept"? Seriously?

Developer gets prison after admitting backdoor was made for malice

Found on Ars Technica on Sunday, 25 February 2018
Browse Software

Huddleston's case gained national attention last March when Daily Beast reporter Kevin Poulsen argued that the case against Huddleston was novel because it prosecuted the developer of "dual-use software" who had "hacked no one."

In addition to receiving 33 months in prison, Huddleston was sentenced to two years of supervised release following his prison sentence.

Yet still the politicians too want mandatory backdoors. It would be safer to have them in jail too.

These LED bulbs offer 100 watts worth of light: Which is best?

Found on CNet News on Saturday, 24 February 2018
Browse Technology

The thing is, most 100-watt incandescents have long been phased out due to rising efficiency standards.

We spent hours testing each light bulb in this roundup, first testing for qualities such as brightness, color temperature and efficiency and then moving on to our dimming and color quality tests.

Traditional bulbs still have their place, and banning them is a short-sightened approach. Educate the customers and leave it up to them. Sometimes, a bulb made of glass and a little metal is more eco-friendly than a mix of plastics and electronics.

Bot-Driven Credential Stuffing Hits New Heights

Found on Info Security on Friday, 23 February 2018
Browse Internet

More than 40% of global log-in attempts are malicious thanks to bot-driven credential stuffing attacks, according to the latest report from Akamai.

The stats chime with similar data from fraud prevention specialist ThreatMetrix, which claimed in its latest Cybercrime report for Q4 2017 that there were 34 million bot attacks during the peak festive shopping period, rising to 800 million for the quarter.

You could say more than 90% and still be correct.

Botched npm Update Crashes Linux Systems, Forces Users to Reinstall

Found on Bleeping Computer on Thursday, 22 February 2018
Browse Software

A bug in npm (Node Package Manager), the most widely used JavaScript package manager, will change ownership of crucial Linux system folders, such as /etc, /usr, /boot.

"This destroyed 3 production server after a single deploy!," one affected user said in a GitHub bug report today. Many others users have taken to Twitter to describe similar issues with dev and production servers, and warn other users not to update.

The bug was first reported a week ago but was left without an answer from npm developers.

Another massive failure coming from npm. This is your reminder that you should never install such a badly designed product that comes with aweful maintenance.

The e-waste warrior, 28,000 copied Windows restore discs, and a fight to stay out of jail

Found on The Register on Wednesday, 21 February 2018
Browse Software

As an e-waste warrior, Eric Lundgren wished to see discarded computers fixed up and reused rather than crammed into holes in the ground. To encourage people to refurbish and continue using unwanted Dell PCs, he burned and distributed 28,000 copies of the IT giant's Windows XP and 7 restore discs.

Arguing that a copy of Windows is essentially useless without a product key, and that all of the recycled machines had their own valid keys, Lundgren's lawyers suggested what he did was merely make it easier for the owners to get something they were already entitled to for free.

Going to jail is tough, but it's twice as bad if you go to jail because of Microsoft.

Microsoft Finally Documents the Limitations of Windows 10 on ARM

Found on Thurrott on Tuesday, 20 February 2018
Browse Software

Microsoft finally published a more complete list of the limitations of Windows 10 on ARM. And that word—limitations—is interesting. This isn’t how Windows 10 on ARM differs from Windows 10 on x86-based systems. It’s how it’s more limited.

64-bit apps will not work.
Certain classes of apps will not run.
It cannot use x86 drivers.
No Hyper-V.
Older games and graphics apps may not work.

Microsoft lists what it cannot do, Linux lists what it can do.