Google finishes 2,048-bit security upgrade for Web privacy Prodded by "concerns about overbroad government surveillance," Google beat an end-of-year deadline to retire Web certificates with less secure 1,024-bit encryption

Never again are you going to get a Google Web site whose security certificate is protected with comparatively weak 1,024-bit encryption.
The Net giant has secured all its certificates with 2,048-bit RSA encryption keys or better, Google security engineer Dan Dulay said in a blog post Monday. Certificates are used to set up encrypted communications between a Web server and Web browser.
That means two things. First, traffic will be harder to decrypt since 1,024-bit keys aren't in use at Google anymore. Second, retiring the 1,024-bit keys means the computing industry can retire the technology altogether by declaring such keys untrustworthy.

Google has been aggressively moving to stronger encryption because of U.S. government surveillance by the National Security Agency. According to documents leaked by former NSA contractor Edward Snowden, the agency gathered bulk data off Internet taps, including unencrypted data sent between company data centers on its own network, and actively worked to undermine encryption.
Google said it beat its internal end-of-year deadline for the 2,048-bit move. It's also moved to encrypt its internal data transfer between data centers, a move that Yahoo also is making.
In other words, the Net's technology giants are working actively to make surveillance, authorized or not, significantly harder.

"Worry in Silicon Valley/Puget Sound: furor over NSA will cost billions cuz foreign customers fear US companies can't guarantee security," tweeted Strobe Talbott, president of analyst firm Brookings Institution, referring to the geographic regions where tech powers such as Google, Facebook, Yahoo, Microsoft, Twitter, Apple, LinkedIn, and Amazon are located.
There's a lot of work to be done yet, though. Google also supports a standard called "forward secrecy," which uses different keys for different sessions so that decrypting a single message doesn't mean previous messages can likewise be decrypted using the same key. But many other Net giants don't support forward secrecy
SOURCE: cnet

Read More

Yahoo recycled ID users warn of security risk Users of Yahoo's recycled ID names say they are receiving the former owner's sensitive information through their new accounts.

(Credit: James Martin/CNET)

Yahoo users who got recycled account IDs said they've found a security risk -- they are receiving emails containing the personal information of former account owners, InformationWeek.com reported Tuesday.
The users told the news site that initially, they were receiving junk mail for the Yahoo ID's previous owner, but then other mail with sensitive information started showing up. This included account information, confirmation for appointments and flights, and event announcements. It appears the old owners must still be giving out the email address without knowing they no longer have access to the account.
One user, an IT security professional named Tom Jenkins, described the potential for identity theft as, "kind of crazy":

I can gain access to their Pandora account, but I won't. I can gain access to their Facebook account, but I won't. I know their name, address, and phone number. I know where their child goes to school, I know the last four digits of their social security number. I know they had an eye doctor's appointment last week and I was just invited to their friend's wedding.

We've contacted Yahoo for a comment and will update if we hear back.
Yahoo told InformationWeek that it takes the "security and privacy of our users very seriously," and has received complaints from "a very small number of users who have received emails through other third parties which were intended for the previous account holder." It continues to ask other companies, the ones sending the emails, to verify accounts by adding a date-specific marker.
Yahoo began releasing recycled IDs in late August, after giving users a month to log in to their accounts and stake their claim. Yahoo shut down any accounts that hadn't been logged in for more than a year, and then put the usernames up for grabs.
SOURCE: CNET

Read More

Hacker video shows how to thwart Apple's Touch ID The video details how the hacker scans and manipulates someone's fingerprint to fool the Touch ID on the iPhone 5S.

(Credit: Screenshot by Lance Whitney/CNET/Vimeo)

One of the hackers who recently tricked Apple's fingerprint sensor now has a video out showing just how he does it.
Earlier this week, a group of hackers in Germany, known as the Chaos Computer Club, took credit for bypassing the biometric security on the Touch ID fingerprint scanner. That hack was accomplished by scanning someone's fingerprint and ultimately using that to gain access to that person's iPhone 5S.
Posted on Vimeo by one of the hackers known as Starbug, the video takes us through the entire process from the initial scan to the actual fingerprint trickery. The hacker scans an iPhone 5S that already has someone's fingerprint. He then tweaks the scan to perfect the image of the fingerprint.
The scan is printed to paper and then to a circuit board, which undergoes a chemical bath. A dummy print eventually emerges, which is used to fool the security of the Touch ID, thus giving the hacker entry into the iPhone.
Starbug told Ars Technica that the hack posed no challenge. He said he expected the process to take a week or two. Instead, it chewed up around 30 hours from start to finish. With better preparation, he claims it would've taken only half an hour.
Despite Starbug's boasts, the procedure shown in the video seems exact and intricate, requiring manipulated scans, chemical baths, and printed circuit boards. And through it all, the hacker would need to hang onto your iPhone 5S. A process that can mimic your fingerprint certainly raises alarm bells, but this particular hack isn't something your average iPhone thief would be able to pull off.
SOURCE:CNET

Read More

Hacker sentenced to three years for breaching police sites

After pleading guilty to computer fraud for hacking into several police Web sites, John Anthony Borell III was sentenced to three years in federal prison on Thursday, according to the Associated Press.
Borell, 22, is from Ohio but was accused of breaching the Web sites of police agencies in Utah, New York, and California, and a municipal Web site in Missouri, in early 2012. According to court documents, the intrusions caused thousands of dollars in damage and forced the Utah police site to be down for nearly three months.
Apparently, after the attack, Borell made several comments on Twitter and other Web sites, which helped law enforcement officials in their investigation.
Borell is said to be a member of the loose-knit hacking collective Anonymous, which has taken credit for numerous online attacks including on the US Department of Justice, Lockheed Martin, Bank of America, and more. Reportedly, the attacks on Utah's police Web sites were done in protest of proposed US anti-piracy legislation.
In addition to his prison sentence, Borell has also agreed to pay $227,000 in damages, according to the Associated Press.
 Source:CNET

Read More

Indian government said to secretly track Web activity

The Indian government reportedly deploys Lawful Intercept and Monitoring systems to track Internet activities of citizens, separate from similar systems used by telcos in the government's Central Monitoring System project.
The Indian government is reportedly carrying out Internet surveillance on its citizens, in contrast with the government's rules and notifications for ensuring communications privacy.
According to an investigation by Chennai-based publication The Hindu, Lawful Intercept and Monitoring (LIM) systems have been deployed by the country's Center for Development of Telematics (D-DOT) to monitor Internet traffic, e-mails, Web browsing, Skype, and other Internet activities by Indian citizens.
The systems are fully owned and operated by the Indian government, unlike similar systems deployed by local Internet Service Providers (ISPs) which have to comply with Indian Telegraph Act and Rule 419(A) of the country's IT rules, the publication reported on Monday.

Read More

DID YOU KNOW THIS??Google's robo-cars mean the end of driving....!!

How Google's robo-cars mean the end of driving as we know it

Why waste your drive time doing the actual driving, when technology can be your chauffeur? The century-old auto culture is on the verge of radical change, and you can thank Google for where it's headed.

Google's self-driving Lexus RX450h

(Credit: Google)

Google's self-driving car initiative is moving into a new phase: reality.
Three years after first showing the world what it was up to -- rolling out a Toyota Prius with laser-scanning hardware awkwardly perched on the roof -- Google is moving its big idea out of the lab and into the real world.
Consider recent developments: A spokesman confirmed to CNET that the company was in what were described as productive talks with automakers involving Google's self-driving technology. Separately, Google is reported to be crafting a partnership with auto supplier Continental. And there's even the possibility of Google-powered robo-taxis sometime in the future.


The computerization of cars
Motivation aside, a big change is unde way, and it requires us to start thinking of cars very differently. Vehicles that drive themselves are the clearest example of what happens when cars transform into full-scale, general-purpose computing systems. But it's not the only example. Self-driving and connected cars will bristle with sensors, negotiate with traffic lights, talk to each other about safety conditions, join into train-like platoons, and become members of intelligent urban transit networks.
Historically, the car industry has focused on passive safety -- items like seatbelts and airbags. With the arrival of active safety technology that lets vehicles take pre-emptive action, cars will use data to help them decide what to do when drivers aren't paying attention or don't know what to do.

A lot of this boils down to communication. Sure, cars are getting more computing smarts, but so much of what's promised requires more data, and that requires ways to transmit it. How will that happen? As with personal computing, it will be a bit of a mess, with multiple networking technologies for multiple needs.
Computing today uses a handful of networks for different circumstances -- Wi-Fi, 3G, 4G, and Bluetooth among them. When automotive computing becomes a facet of personal computing, you can expect those standards to carry over. But then you can add some new network technologies designed to serve vehicles. The biggest are the 802.11p and the accompanying higher-level dedicated short-range communications (DSRC) standards, which govern how vehicles communicate with each other (V2V) and with infrastructure (V2I).
That technology, which rides the 5.9GHz frequency range for radio communications, can be used for things like collision avoidance, managing traffic at intersections, and linking cars into coordinated, fuel-efficient groups called platoons. Carmakers, however, are worried about interference on the 5.9GHz band if the US Federal Communications Commission permits other uses of the spectrum.

SOURCE:CNET

Read More

How to check if a shortened link is safe using URL Uncover:: The Web is a scary place where shortened links can take you to the darkest corner of the Internet.

(Credit: Jason Cipriani/CNET)

There is no shortage of Web services to help you verify that a shortened link is legit and not something that's going to load you up with malware or steal personal information. But when it comes to online privacy, it's always good to have options. Instead of adding a "+" to the end of a bit.ly link, or using Unshorten.it, give URL Uncover a look the next time you get suspicious.

(Credit: Screenshot by Jason Cipriani/CNET)

Addictive Tips recently wrote about URL Uncover, which will let you enter a shortened URL from over 100 different shortening services. After submitting the URL, you'll be given a screenshot of the Web site, the lengthened link, any keywords associated with the page, and most importantly a virtual thumbs-up or -down indicating whether the site is safe (see below). The green thumbs-up is provided by McAfee Site Advisor.

(Credit: Screenshot by Jason Cipriani/CNET)

Perhaps the best part about this particular service is that it's mobile-friendly. I've been able to access the site and use the service on a wide range of devices without issue. Sure, it's a pain to take the time to copy and paste a link from a rogue DM or mention on Twitter into a Web site in another app, but the time it can potentially save you is well worth it.

SOURCE:CNET

Read More

DO YOU KNOW THIS??'Doomsday Plane' Would Save President and Joint Chiefs in Apocalypse Scenario

Breaking News | Celebrity News | More ABC News Videos

In the event of nuclear war, a powerful meteor strike or even a zombie apocalypse, the thoroughly protected doomsday plane is ready to keep the president, secretary of defense, Joint Chiefs of Staff and other key personnel in the air and out of danger. It may not deflect a Twitter photo scandal, but it can outrun a nuclear explosion and stay in the air for days without refueling.

The flight team for the E-4B, its military codename, sleeps nearby and is ready to scramble in five minutes. It was mobilized in the tumultuous hours after planes crashed into the World Trade Center, the Pentagon and southern Pennsylvania on 9/11.

"If the command centers that are on the ground in the United States have a failure of some sort, or attack, we immediately get airborne. We're on alert 24/7, 365," Captain W. Scott "Easy" Ryder, Commander, NAOC, told ABC News' Diane Sawyer as she traveled to Afghanistan with Secretary of Defense Robert Gates on the apocalypse-proof plane. "Constantly there's at least one alert airplane waiting to get airborne."

Watch "World News" tonight on ABC to learn more about the Air Force's last line of defense.

All E-4B aircraft are assigned to the 55th Wing, Offutt Air Force Base, Neb. The modified 747s can travel at speeds up to 620 miles per hour, 40 miles per hour faster than their commercial counterparts.

The $223 million aircraft is outfitted with an electromagnetic pulse shield to protect its 165,000 pounds of advanced electronics. Thermo-radiation shields also protect the plane in the event of a nuclear strike.

A highly-trained security team travels with the plane.

"The first people off of the airplane are these guys, they'll position themselves appropriately around the airplane," Ryder said to ABC News. "The secretary also has his own small security staff that does similar things. So these guys are predominately designed to protect our airplane, and the secretary's staff protects him, as an individual."

Even though it carries VIPs, their staff and security personnel, the plane is highly fuel efficient. The plane can stay in-flight for days without refueling, a necessity if circumstances demanded the plane's use by the nation's top officials.

A precision tech team mans the sensitive electronic technology found on the plan. There is so much powerful electrical equipment onboard a specially upgraded air-conditioning system is necessary to keep it cool and functional.

"Give us the phone number of anybody, anytime, anyplace, anywhere on earth, we can get a hold of them," Master Sgt. Joe Stuart, US Air Force, told Diane Sawyer.

It can even communicate with submerged submarines by dropping a five-mile-long cable out the back of the plane. "[We] drop is down and [it] transmits coded message traffic to US submarines," Ryder told ABC News.

Although the extreme amount of survival technology on the plane more than makes up for it, the plane lacks the amenities found in bases on the ground.

"It's like being Fedexed," Gates told Sawyer. "It's fairly Spartan, with no windows or anything."

Even the Secretary of Defense only gets a tiny bathroom with a sink, but no shower. A small trade-off for being able to board this plane as the rest of us dive for cover in a worst-case scenario.

Some more details on the general characteristics of the plane, according to the official U.S. Air Force website:

 Primary Function: Airborne operations center

 Contractor: Boeing Aerospace Co.

 Power Plant: Four General Electric CF6-50E2 turbofan engines

 Thrust: 52,500 pounds each engine

 Wingspan: 195 feet, 8 inches (59.7 meters)

 Length: 231 feet, 4 inches (70.5 meters)

 Height: 63 feet, 5 inches (19.3 meters)

 Weight: 410,000 pounds (185,973 kilograms)

 Maximum Takeoff Weight: 800,000 pounds (360,000 kilograms)

 Fuel Capacity: 410,000 (185,973 kilograms)

 Payload: communications gear permanently installed on aircraft

 Speed: 602 miles per hour (523 knots)

 Range: 6,200 nautical miles

 Ceiling: Above 30,000 feet (9,091 meters)

 Crew: Up to 112 (flight crew and mission crew)

 Unit Cost: $223.2 million (fiscal 98 constant dollars)

 Initial operating capability: January 1980

 Inventory: Active force, 4

ABC News' James Wang contributed to this article.

Read More

Academic banned from publishing car-hacking paper

A computer scientist at a UK university has been banned from publishing an academic paper that reveals the codes used to start luxury cars.
Flavio Garcia from the University of Birmingham received an injunction from the UK high court after he managed to identify the unique algorithm that cars use to verify the identity of the ignition key, The Guardian reported.
German car manufacturer Volkswagen appealed for the injunction when it realised that Garcia and two other cryptography experts from a Dutch university had figured out how to crack the security system on several luxury car brands under its ownership, including Porsche, Lamborghini or Audi.
Volkswagen wants the research to remain unpublished because it fears that it could "allow someone, especially a sophisticated criminal gang with the right tools, to break the security and steal a car".
The cars are protected by an algorithm that works out the codes that are sent between the key and the car known as the Megamos Crypto system.
The scientists were planning to publish their paper – Dismantling Megamos Crypto: Wirelessly Lockpicking a Vehicle Immobiliser – at the Usenix Security Symposium in Washington DC next month before the court imposed an interim injunction.
Volkswagen asked Garcia and his team to publish an amended version of the paper without the secret codes but the scientists declined, claiming that the public has a right to see holes in the security system it relies on and insisting that this wasn’t an attempt to give criminals a hand in stealing cars.
Garcia and his colleagues from the Stichting Katholieke Universiteit, Baris Ege and Roel Verdult, said they were "responsible, legitimate academics doing responsible, legitimate academic work".
Mr Justice Birss said he recognised the right for academics to publish their work but it would mean, "that car crime will be facilitated".

Read More

AlienVault offers free IP address alerts as it expands crowdsourced security

AlienVault hatabase.

Described as a sort of ‘neighbourhood watch’ for participating organisations, the Open Threat Exchange Reputation Monitor Alert Service (to give it its full name) is a publically-accessible equivalent of the Open launched in 2012 to share the same data among its own customers.
Threat Exchange (OTX) AlienVault
As an aside, the Open Threat Exchange had now been renamed OTX Reputation Monitor and will be broadened to tie together all of the firm’s internal intelligence-gathering initiatives, the firm said.

In essence this allows firms that are not customers of AlienVault to get SIEM-like alert data that might turn up on the security firm’s Open Source Security Information Management (OSSIM) reputation database, fed to it by paid customers or other sources.
If it works efficiently, it could be an ingenious way to extend some of the benefits of crowdsourcing, although that depends on how likely it is that AlienVault’s data-gathering will record issues on a given set of IP addresses. Signing up for the service takes minutes and requires no software.
“Cyber criminals often use compromised systems to launch attacks against different targets,” said AlienVault CTO, Roger Thornton.

“With a service that harnesses crowd-sourced threat intelligence, we can detect these attacks before damage is done. Our OTX Reputation Monitor Alert leverages the broadest scope of data, sourced from the largest community of SIEM deployments, and is free to all IT and security professionals.”
AlienVault said it would also monitor DNS registration and SSL certificates for submitted domains and IPs.
“Today, we re-launch OTX as an even broader initiative to provide free resources, projects, services and threat intelligence to IT security professionals with the goal to unify efforts to combat the ever-increasing malicious threats that plague organisations,” said AlienVault CEO, Barmak Meftah on the re-launch and expansion of the underlying OTX programme.

Read More

Bogus Chrome, Firefox extensions pilfer social media accounts The extensions carry what could be a stolen digital signature, according to Trend Micro

Trend Micro has found two malicious browser extensions that hijack Twitter, Facebook and Google+ accounts.
The attackers plant links on social media sites that, if clicked, implore users to install a video player update. It is a common method hackers use to bait people into downloading malicious software.
The bogus video player update lures people in a macabre manner: it says it leads to a video of a young woman committing suicide, according to Trend's description.
The video player update carries a cryptographic signature that is used to verify that an application came from a certain developer and has not been modified, wrote Don Ladores, a threat response engineer, with Trend.
"It is not yet clear if this signature was fraudulently issued, or a valid organization had their signing key compromised and used for this type of purpose," he wrote.
Hackers often try to steal legitimate digital certificates from other developers in an attempt to make their malware look less suspicious.
If the video update is executed, the malware then installs a bogus Firefox or Chrome extension depending on which browser the victim uses.

The malicious plugins try to appear legitimate, bearing the names Chrome Service Pack 5.0.0 and the Mozilla Service Pack 5.0. Ladores wrote that Google now blocks the extension that uses its name. Another variation of the extension claims it is the F-Secure Security Pack 6.1.0, a fake product from the Finnish security vendor.
The plugins connect to another website and download a configuration file, which allow them to steal the login credentials from a victim's social networking accounts such as Facebook, Google+, and Twitter. The attackers can then perform a variety of actions, such as like pages, share posts, update statuses and post comments, Ladores wrote

Read More

Opera 16 Next is out

Opera Software, just like Google or Mozilla, decided to make available three different Opera release channels to provide developers and enthusiasts with options to test new features before they reach the stable build, and get some data and bug reports from the community in return.
We are currently still waiting for Opera Dev to be released, while both stable and next builds of the browser are already available. Opera Dev will be what Chrome Dev is for the Chrome browser, and Aurora for Firefox. It won't be like Firefox Nightly though which may get updates several times a day depending on how active Mozilla is.
For now, Opera Next is the cutting edge version of the Opera browser, and it is this browser that got upgraded to version 16 today. This would not really be important but it is the first release with a 16 in front, which makes it somewhat special.
The release is not officially announced yet and it is not clear if it ever will be. If you are running Opera Next, you may receive it via auto-update. If you do not want to wait that long, you can head over to the Opera ftp server and download it from there.
Note: There is no "check for updates" feature built-into Opera (yet). What this means is that you will get the update when it is your turn to get it. The only way to speed things up is to download the latest version manually and install it. The reason behind this apparently is to avoid the servers being hammered by user requests.
A change log has not been posted (yet) and you will be hard pressed finding any changes to previous versions of the browser. There is one that I was able to find out about, but it is not the long awaited bookmarking feature or other features of Opera 12.x that are still missing in Opera 16.
You can enter opera:flags into the address bar to display experimental features that you may enable or disable here. This is similar to Chrome's experimental flag (chrome:flags).

It allows you to enable several interesting features, including:

1. Synchronization (it is not clear how enabling this differs from the sync feature that is build into Opera)
2. Enable Download Resumption which adds a context menu to Opera to continue or restart interrupted downloads.
3. Enable extensions to run on opera:// urls.
4. Disable hyperlink auditing (pinging).
5. Smooth scrolling (Windows only).
6. Enable Opus and VP8 playback in video elements.

There are 56 experiments in total listed on the page, of which some may not be available for the platform you are using. For Opera Next on Windows 7, 53 of the 56 were available while three were not. Changes take effect after a restart of the browser.
Opera Next is a beta version that is still in development. It is very likely that we will see the missing bookmarking capabilities land in Opera 16 before it reaches stable status. (via Deskmodder)
Update: The official announcement has been posted on the desktop team blog. The release includes a number of changes according to it:

• W3C Geolocation API support.
• Form auto-filling.
• Jump List support on Windows 7 and 8.
• Presentation Mode support on Mac OS X.
• Based on Chromium 29.

Read More

Apple reveals that developer portal was hacked, announces system overhaul

---

Been paying attention to Twitter recently? You might have noticed Apple developers complaining about the company's developer portal, which has been out of service for a number of days. Today, Apple acknowledged the outage, explaining that the site was taken down to combat a security breach. "Sensitive personal information was encrypted and cannot be accessed," Cupertino told developers in an email. "However, we have not been able to rule out the possibility that some developers' names, mailing address and/or email addresses may have been accessed."

Naturally, the company is taking the breach very seriously, and has said that it'll be rebuilding its entire developer system database and updating servers to prevent future incursions. Apple also assured developers whose developer accounts were up for renewal during the outage would not have their software pulled from the App Store. Furthermore, the company told MacWorld that customer information and app code was not compromised during the attack.

Read More