Emergency Adobe Flash Patch Fixes Zero Day Under Attack

Found on Threat Post on Tuesday, 23 June 2015
Browse Internet

Adobe today released an out-of-band patch for a Flash Player zero-day vulnerability being used in targeted attacks by an APT gang known for its storehouse of exploits targeting unpatched browser-based vulnerabilities.

“Any time one of these groups is using a zero day and casting such a wide net, it’s pretty significant, especially since the activity started in early June and a patch was not released until today,” Oppenheim said. “That’s a big window, and possibly tons of victims affected.”

The biggest bug is Flash itself. It ridden with holes and the top reason for infections. In all the years, Adobe has failed hard to make it at least somewhat secure. The best solution is to just remove it from all your systems and move on. With HTML5, there is no real reason to use this piece of bugware anymore.

Germany Says You Can't Sell Adult Ebooks Until After 10 PM

Found on Techdirt on Monday, 22 June 2015
Browse Internet

The law behind this baffling proclamation states it is intended to protect children from coming to harm via "advertising or teleshopping." It was written in 2002, and was no less stupid in its belief that it could somehow force online retailers to take certain items off the "shelves" for two-thirds of the day. It's only receiving attention now because the Youth Protection Authority trying to hammer it into place over bits of the internet.

And no one will be saved, Youth Protection Authority or no. But the YPA gets to say it tried, and I guess that's all that matters. It will just have to live with the mocking laughter.

If someone tells you a story like this, the natural reaction is to reply "They cannot be that stupid". They are though.

Kim Jong-un claims to have cured Aids, Ebola and cancer with single miracle drug

Found on The Independent on Sunday, 21 June 2015
Browse Pranks

North Korea has created a wonder drug which not only cures Aids, but also eradicates Ebola and cancer, if the latest proclamation from the country’s news agency is to be believed*.

The dictatorship, which is known for making far-fetched claims about its achievements, says that the medicine will apparently be injectable and will be known by the name of Kumdang-2.

The dictatorship is known for making outlandish claims about its own prowess. The state claims that Kim Jong Il invented the hamburger and had magical powers which meant he did not need to use the toilet.

At least the last claim seems plausible if you look at Kim Jong-un's body.

DuckDuckGo on CNBC: We’ve grown 600% since NSA surveillance news broke

Found on Technical.ly Philly on Saturday, 20 June 2015
Browse Internet

“We’re doing about three billion searches a year,” Weinberg said, “so we’re already pretty mainstream.”

Browsers Firefox and Safari also made DuckDuckGo available last year.

So some people do want privacy. Not all hope is lost.

Privately Owned Armored Trucks Raise Eyebrows After Attack on Dallas Police

Found on New York Times on Friday, 19 June 2015
Browse Various

As Mr. Funicello’s vehicle illustrates — and as the attack on the Dallas Police Headquarters last weekend by a man in an armored van that was apparently bought on eBay makes clear — anyone can buy virtually anything online and drive virtually anything on the road.

Officer Tilley and other police officials said, however, that they were not aware of any violations for which an armored van such as Mr. Boulware’s might be cited. There are size and weight limits for vehicles in most states, but many armored vans and other military-style vehicles like Humvees do not exceed them.

The police buys military grade weapons, so it's just fair if the average citizen buys armored trucks.

The Web is getting its bytecode: WebAssembly

Found on Ars Technica on Thursday, 18 June 2015
Browse Internet

However, there are well-known ways of providing the advantages of JavaScript without those perceived downsides: bytecode runtimes like Java and .NET. Unlike script files, the bytecode represents a low-level, fairly compact representation of a program.

WebAssembly, or wasm for short, is intended to be a portable bytecode that will be efficient for browsers to download and load, providing a more efficient target for compilers than plain JavaScript or even asm.js.

What could possibly go wrong with compiled binaries loaded into your browser. It has been tried before, and Java, ActiveX et al are examples of the failures.

Free encryption project 'Let's Encrypt' to issue first digital certificates next month

Found on The Stack on Wednesday, 17 June 2015
Browse Internet

The project is funded by the Internet Security Research Group (ISRG), a new Californian public-benefit group backed by leading tech firms including Mozilla, The Electronic Frontier Foundation (EFF) and Cisco.

Website operators are generally hesitant to use SSL/TLS certificates due to their cost. An extended validation (EV) SSL certificates can cost up to $1,000 (approx. £640). It is also a complication for operators to set up encryption for larger web services.

EV certs however also provide insurance. That aside, free and easy SSL is good and will help to weed out the self signed certificates which are still used by some services.

Huge Loss For Free Speech In Europe: Human Rights Court Says Sites Liable For User Comments

Found on Techdirt on Tuesday, 16 June 2015
Browse Censorship

The court had found that even if a website took down comments after people complained, it could still be held liable because it should have anticipated bad comments in the first place.

The Court then notes that freedom of expression is "interfered with" by this ruling, but it doesn't seem to care -- saying that it is deemed "necessary in a democratic society."

For a Europe that is supposedly trying to build up a bigger internet industry, this ruling is a complete disaster, considering just how much internet innovation is based on enabling and allowing free expression.

This is one of the most idiotic rulings out there, but a similar system already exists. In China. Everybody in the western world complains about the strict chinese censorship (except for a few judges obviously), yet this decision will have pretty much the same effect. A democratic society should be able to deal with "bad" comments in a civilized way and tolerate different opinions. Totalitarian regimes don't.

Password Manager LastPass Got Breached Hard

Found on Wired on Monday, 15 June 2015
Browse Internet

On Monday password manager service LastPass admitted it had been the target of a hack that accessed its users’ email addresses, encrypted master passwords, and the reminder words and phrases that the service asks users to create for those master passwords.

“We are confident that our encryption measures are sufficient to protect the vast majority of users,” LastPass CEO Joe Siegrist wrote in a note to customers. “Nonetheless, we are taking additional measures to ensure that your data remains secure, and users will be notified via email.”

Trust us they say. Store your passwords online they say.

Britain pulls out spies as Russia, China crack Snowden files - report

Found on Reuters on Sunday, 14 June 2015
Browse Politics

Britain has pulled out agents from live operations in "hostile countries" after Russia and China cracked top-secret information contained in files leaked by former U.S. National Security Agency contractor Edward Snowden, the Sunday Times reported.

Russia and China have both managed to crack encrypted documents which contain details of secret intelligence techniques that could allow British and American spies to be identified, the newspaper said citing officials.

A few days ago the USA accidentally found out that secret government data has been accessed for up to a year by foreign intelligence services. Data which also includes security clearances and other very interesting information. With the close ties between USA and Britain, it would not be much of a surprise if that data contains information about MI6 agents too. Today Russia and China suddenly "crack" Snowden's documents, two years after he copied them. This is such a convenient timing that it hurts. Plus, whenever reporters ask the government about security issues they get a "no comment" reply, unless the cat is already out of the bag; but this time, officials confirm it. Besides, it would be way more valueable for China and Russia to keep an successful crack secret for as long as possible so they can use the information for their own benefits. Tinfoil-hat and false flag time.