Target's data breach: Yes, it gets worse

Found on CNet News on Saturday, 18 January 2014
Browse Internet

There appears to be no end in sight for just how bad the unprecedented hack attack at Target was last holiday season.

Now Reuters is reporting that cyberintelligence firm IntelCrawler has unearthed evidence pointing toward at least six ongoing schemes at U.S. merchants with credit card processing systems plagued by the same type of malicious software.

According to IntelCrawler's sources, the malware has been tested out and infected point-of-sale hardware across Australia and Canada as well as the United States.

It's a global economy. Identical payment terminals are in use in many different places around the world, so it shouldn't be much of a surprise that they can get infected everywhere.

President Obama Surpasses Exceptionally Low Expectations On NSA Reforms, But Reforms Are Still Very Weak

Found on Techdirt on Friday, 17 January 2014
Browse Various

Similar to the original task force report, for which the White House first leaked claims that the recommended changes would be "cosmetic"... and then presented something a little more powerful, to try to win people over by beating low expectations.

Bulk data collection will still continue in some form, despite the fact that it appears that bulk data collection is rarely useful, compared to targeted surveillance. There will be slightly more oversight, despite the fact that oversight in the past has failed. There will be no effort to stop trying to compromise the technology of American (and foreign) companies leading to serious questions about our tech industry's ability to do business overseas (and at home).

Also not to forget: what's said and what's done is not necessarily the same. Or in other words: they can just lie to the people. It's not like that has never happened before.

Man Jailed For Refusing To Reveal USB Password

Found on TechWeek on Thursday, 16 January 2014
Browse Legal-Issues

A man has received an extra four months in jail after he failed to reveal the password for a USB stick the police and GCHQ were unable to crack.

He received additional time inside for not providing assistance on the US password, which he eventually revealed as “$ur4ht4ub4h8″, which related to a chapter in the Koran.

So much for your rights to remain silent and not to incriminate yourself. You'll end up in jail for years just because you don't give out your password.

Patent Troll Sues The FTC, Saying It Has A First Amendment Right To Shake Down Companies Using A Scanner

Found on Techdirt on Wednesday, 15 January 2014
Browse Legal-Issues

MPHJ had become one of the poster children for extreme patent trolls abusing the system, and various states had begun suing the company for threatening local businesses. In fact, just today, NY apparently settled with MPHJ -- and revealed that MPHJ acquired its five patents for... $1.

MPHJ argues that it has a first amendment right to shake down companies for money. It's going to have a very difficult time supporting that argument. It seems unlikely that MPHJ's case will get very far.

It can only be repeated over and over again: just remove patents altogether. They are causing by far more harm than good.

Windows 9 Needs to Be Free: 10 Reasons Why

Found on eWEEK on Tuesday, 14 January 2014
Browse Software

According to WinSuperSite's Paul Thurrott, the operating system, currently code-named "Threshold," predictably will be called Windows 9.

If it launches on time, Microsoft should make a very un-Microsoft move that will shock some, excite others and potentially cause panic among its investors: turn Windows free. The time has come for Microsoft to stop licensing the software to OEMs and finally offer it at no charge to its PC partners and consumers.

Could it be that MS realizes that Linux has reached a point where even common users consider it a good alternative? Windows is continously going downhill. Years ago, it was fine for desktops since it didn't annoy the users. These days, it looks like MS wants to annoy you more and more with its OS.

Do NSA's Bulk Surveillance Programs Stop Terrorists?

Found on New America on Monday, 13 January 2014
Browse Politics

An in-depth analysis of 225 individuals recruited by al-Qaeda or a like-minded group or inspired by al-Qaeda’s ideology, and charged in the United States with an act of terrorism since 9/11, demonstrates that traditional investigative methods, such as the use of informants, tips from local communities, and targeted intelligence operations, provided the initial impetus for investigations in the majority of cases, while the contribution of NSA’s bulk surveillance programs to these cases was minimal.

The controversial bulk collection of American telephone metadata, which includes the telephone numbers that originate and receive calls, as well as the time and date of those calls but not their content, under Section 215 of the USA PATRIOT Act, appears to have played an identifiable role in initiating, at most, 1.8 percent of these cases.

The fight against terrorism is just an excuse; intelligence services want to know everything about the citizens.

Girl wants a dragon, so scientists make one

Found on CNet News on Sunday, 12 January 2014
Browse Science

Young Sophie Lester wrote a letter to CSIRO scientists in hopes of getting a dragon of her very own, and in the process charmed them with her request.

Their apology to Sophie went viral and ended up on so many blogs that CSIRO decided to take its appreciation of the little girl's letter a step further, by making her a dragon with the aid of a 3D printer.

Toothless is currently on her way to Sophie Lester's home, now proving that scientists can truly create anything -- even dragons for little girls.

That should make a little girl really happy.

Flaws Plague Leading Mobile Banking Apps

Found on Threatpost on Saturday, 11 January 2014
Browse Internet

An alarming percentage of mobile banking applications for iOS fail to implement basic protections that would safeguard against man-in-the-middle attacks, session hijacking, memory corruption, and credential theft.

Sanchez said 90 percent of the applications he looked at sent users to a number of links that were not encrypted with SSL, while close to half of the apps did not validate the SSL certificates presented, putting customers at risk to man-in-the-middle attacks where an attacker could inject malicious javascript or HTML code as part of a phishing scam, for example.

The management usually cares only about pretty looks, not about security. If you tell them you adjusted the layout by a few pixels to make it look nicer, you get praised. If you tell them that the project gets delayed by a month because the security models are not implemented correctly they think you're wasting time.

High-end CNC machines can't be moved without manufacturers' permission

Found on Boing Boing on Friday, 10 January 2014
Browse Technology

The person who started the thread owns the machine outright, but has discovered that if he moves it at all, a GPS and gyro sensor package in the machine automatically shuts it down and will not allow it to restart until they receive a manufacturer's unlock code.

Customers will not like this. Mori Seiki hopefully sees a lack of interest in the NV5000 A/40 for exactly this reason.

Security Experts Call For Boycott of RSA Conference In NSA Protest

Found on Slashdot on Friday, 10 January 2014
Browse Technology

Last month, it was revealed that RSA had accepted $10 million from the NSA to use a flawed default cipher in one of its encryption tools.

Jeffrey Carr, a security industry veteran who works in analyzing espionage and cyber warfare tactics, took his cancellation a step further calling for a boycott of the conference, saying that RSA had violated the trust of its customers.

More and more people are fed up with these dubious (and sometimes illegal) methods. The government cannot ignore this forever and needs to act.