Wave Coffee Table
Source: mousarris | Wave Coffee Table
Wave City 3d printed Coffee Table
Reply
Observable universe logarithmic illustration
Silent Circle Blackphone Icera Modem Security Patch
SentinelOne director of mobile research Tim Strazzere said he found an open socket—shell@blackphone:/dev/socket $ ls l at_pal srwrwrw radio system 20150731 17:51 at_pal—accessible on the phone that the agps_daemon, a system-level shell is able to communicate with. The vulnerability, CVE-2015-6841, is specific to the modem used by the Blackphone, the Icera modem developed by nVidia. The manufacturer announced in May it was discontinuing its Icera softmodem business.
Strazzere said that an attacker could use a malicious app, or chain together a Stagefright-type exploit with this vulnerability, to send commands to the phone’s radio.
The result poses a number of privacy and security woes for victims; an attacker could enable call forwarding, mute the phone, or send and read SMS messages all without leaving a trace on the device.
Source: Silent Circle Blackphone Icera Modem Security Patch | Threatpost | The first stop for security news
Time Warner Cable says up to 320,000 customers’ data may have been stolen
Time Warner Cable Inc said on Wednesday up to 320,000 customers may have had their email passwords stolen.
The company said email and password details were likely gathered either through malware downloaded during phishing attacks or indirectly through data breaches of other companies that stored Time Warner Cable’s customer information, including email addresses.
Source: Time Warner Cable says up to 320,000 customers’ data may have been stolen
Drupal – Insecure Update Process, has been known since 2012
Source: IOActive Labs Research: Drupal – Insecure Update Process
Issue #1: Whenever the Drupal update process fails, Drupal states that everything is up to date instead of giving a warning.
Issue #2: An attacker may force an admin to check for updates due to a CSRF vulnerability on the update functionality
Issue #3: Drupal security updates are transferred unencrypted without checking the authenticity, which could lead to code execution and database access.
Checkpoint chap’s hack whacks air-gaps flat
The Israel-based duo pried apart and compromised KVMs (keyboard video mouse) units such that they could download malware and compromise attached computers.
The attack, demonstrated at the Chaos Communications Congress in Hamburg last month is notable because KVMs are used to control multiple machines. A compromised unit would not be immediately suspicious to most admins and could compromise all computers that attach to it, using those with internet links to stay updated and exfiltrate data.
The KVM would download malware from an internet-connected machine and pass it into the unit’s memory.
Source: Checkpoint chap’s hack whacks air-gaps flat
CBP wordt Autoriteit Persoonsgegevens
Per 1 januari is de naam van het College bescherming persoonsgegevens (CBP) veranderd in Autoriteit Persoonsgegevens. Voortaan kan de Autoriteit Persoonsgegevens boetes opleggen en zijn organisaties verplicht ernstige datalekken direct te melden aan de toezichthouder. Onvoldoende zorgvuldige omgang met persoonsgegevens levert voortaan dus zowel een boete als reputatieschade op. De maximale boete is 820.000 euro.
Source: Nieuwe taken voor Autoriteit Persoonsgegevens – Emerce
Microsoft has patented the slider bar
Graphical slider bars like this – used for setting audio volume, fill color, or the zoom scale of a document – have been around since the dawn of the mouse because it’s obviously the most efficient way of adjustment. But in 2007 Microsoft was granted design patent D554,140 [PDF], giving it rights to the concept.
On December 18, Microsoft cited the design patent, along with eight others, in a lawsuit against Corel (remember them?) for copying the design style of Redmond’s Office suite in the Canadian firm’s Home Office software.
Source: What did we learn today? Microsoft has patented the slider bar
Patents and copyright are stupid and should never last for more than 5 years.
Spying on Congress and Israel: NSA Cheerleaders Discover Value of Privacy Only When Their Own Is Violated
NSA under President Obama targeted Israeli Prime Minister Benjamin Netanyahu and his top aides for surveillance. In the process, the agency ended up eavesdropping on “the contents of some of their private conversations with U.S. lawmakers and American-Jewish groups” about how to sabotage the Iran Deal. All sorts of people who spent many years cheering for and defending the NSA and its programs of mass surveillance are suddenly indignant now that they know the eavesdropping included them and their American
Oh dear, so you’re all for spying on people unless it’s suddenly yourself?
Microsoft failed to warn victims of Chinese email hack
Microsoft Corp (MSFT.O) experts concluded several years ago that Chinese authorities had hacked into more than a thousand Hotmail email accounts, targeting international leaders of China’s Tibetan and Uighur minorities in particular – but it decided not to tell the victims, allowing the hackers to continue their campaign, according to former employees of the company.
Source: Microsoft failed to warn victims of Chinese email hack: former employees
This poor policy is what you get when there is no legal framework requiring disclosure.
Axis VIDIUS ™ – The World’s Smallest FPV Drone at $95
The all-new Axis VIDIUS Drone is the World’s Smallest First Person View Drone™, capable of flying up to 100 feet away, performing 360 degree flips and rolls all while streaming and recording live video! You can control the VIDIUS from your Android or Apple device or the included 2.4 gHz controller. The live video feed is transmitted to your device through a wifi connection and can be recorded and shared right from the free VIDIUS Drone App to social media, blogs, messaging, email and more!
FEATURES:
World’s Smallest FPV Drone™ – 4.3cm x 4.3cm x 2.5cm
Live First Person View Video Camera Puts You in The Pilots Seat!
Control Flight with Included 2.4 gHz Controller, Smartphone or Tablet
Stream and Record Live Video & Still Images in 420p During Flight!
5-7 Minute Flight Time per 20 Minute Charge via USB Cable; 150 mAh Battery
3-Speeds Pre-programmed for Desired Level of Flight Sensitivity
6-Axis Gyro Stabilization Keeps Drone Stable and Centered
360 Degree Rotational Yaw Allows Users to Seamlessly Adjust Orientation
Pre-Programmed “Trick Mode” Algorithm Provides Amazing Flips and Rolls!
Bright LED Colored Lights for Night Flight and Drone Orientation
Super small and lightweight, NO FAA Registration Required!
Source: Axis VIDIUS ™ – The World’s Smallest FPV Drone™
3D printing polymer-derived ceramics now possible
Because ceramics cannot be cast or machined easily, three-dimensional (3D) printing enables a big leap in geometrical flexibility. We report preceramic monomers that are cured with ultraviolet light in a stereolithography 3D printer or through a patterned mask, forming 3D polymer structures that can have complex shape and cellular architecture. These polymer structures can be pyrolyzed to a ceramic with uniform shrinkage and virtually no porosity. Silicon oxycarbide microlattice and honeycomb cellular materials fabricated with this approach exhibit higher strength than ceramic foams of similar density. Additive manufacturing of such materials is of interest for propulsion components, thermal protection systems, porous burners, microelectromechanical systems, and electronic device packaging.
Source: Additive manufacturing of polymer-derived ceramics
They also withstand hugely high temperatures
2nd database with 56m records exposed due to misconfiguration, looks similar to breach with 191m records
Around the same time the first database was discovered a second, smaller database was also found by researcher Chris Vickery. This second database contains voter profiles similar to those previously discovered, however, it also includes records that hold targeted demographic information.
MORE ON CSO:Lost in the clouds: Your private data has been indexed by GoogleWhile the overall total of records is lower (56,722,986 compared to 191 million) it’s still a concerning figure, but this discovery took a steep downturn when more than 18 million records containing targeted profile information were added to the mix.
This second database has voter information from states that began with the letters A-I, but excluding Illinois and Iowa. The scattered information suggests the data was being added in stages, and the exposed database wasn’t intended for public disclosure.
What’s in the database?The second database contains the general voter profile, which includes a voter’s name, address, phone number, date of birth, voting record, etc. In fact, comparing records from both databases confirmed they are essentially the same, but the dates on the second database are newer (April 2015) and some of the field names are different – suggesting the core data came from the same source file.
This source file has been previously identified by political experts as Nation Builder Election Center data. This is further supported by the existence of an nbec_precinct_code and a voter ID code consisting of 32 letters and numbers separated by dashes.
As mentioned in the first story, Nation Builder is under no obligation to identify customers, and once the data has been obtained, they cannot control what happens to it.
While the previously discovered voter database contained more records, this second database, though smaller, contains more information. The standout issue is that these additional data points are targeted towards building an issues-based profile of the voter. While that might be fine for any number of election campaigns, having this data exposed to the public is a goldmine for criminals.
The second database contains several fields for custom text. Depending on the record some of them have answers, while others do not. There’s also fields that flag the profile as being copied from another data source, and those that determine if the voter has been contacted. In addition, there are fields for determining of the voter is active and if they’re a donor.
Other fields include email address, something that wasn’t part of the larger voter database covered last week; as well as records focused on health issues, gun ownership, household values (e.g., religion / social issues), fishing and hunting interests, auto racing interests, longitude and latitude of the voter, income level, and occupation.
When it comes to overlap and additions to the basic voter file, the additional fields in this second database look at gender identification, political party affiliation, political contributions, religious affiliation and if they’re a religious donor, a field denoting bible lifestyle, as well as how many robocall (auto dialed) campaigns they’ve been part of.
Source: 18 million targeted voter records exposed by database error
Dutch govt says no to backdoors, slides $540k into OpenSSL without breaking eye contact
A government position paper, published by the Ministry of Security and Justice on Monday and signed by the security and business ministers, concludes that “the government believes that it is currently not appropriate to adopt restrictive legal measures against the development, availability and use of encryption within the Netherlands.”
The conclusion comes at the end of a five-page run-through of the arguments for greater encryption and the counter-arguments for allowing the authorities access to the information.
“By introducing a technical input into an encryption product that would give the authorities access would also make encrypted files vulnerable to criminals, terrorists and foreign intelligence services,” the paper noted. “This could have undesirable consequences for the security of information communicated and stored, and the integrity of ICT systems, which are increasingly of importance for the functioning of the society.”
The formal position comes just months after the Dutch government approved a €500,000 ($540,000) grant to OpenSSL, the project developing the widely used open-source encryption software library
Source: Dutch govt says no to backdoors, slides $540k into OpenSSL without breaking eye contact
OpenDNSSEC releases support for > 50 zones
Source: OpenDNSSEC » About
Why is Microsoft monitoring how long you use Windows 10?
This might seem like a slightly strange statistic for Microsoft to keep track of, but the company knows how long, collectively, Windows 10 has been running on computers around the world. To have reached this figure (11 billion hours in December, apparently) Microsoft must have been logging individuals’ usage times
Source: Why is Microsoft monitoring how long you use Windows 10?
Feds widen probe into lottery IT boss who rooted game for profit
37 US states could have been scammed by rogue security guy
In July, Eddie Tipton, 52, was found guilty of installing a rootkit in the MSLA’s random-number generating computer that allowed him to predict the digits for future winning tickets. He also tampered with security cameras to cover up his time at the keyboard, the court heard.
Tipton was sentenced to ten years in prison after CCTV caught him buying a $16.5m winning ticket in the Iowa state lottery. He is free on bail while appealing his conviction.
Meanwhile, investigators claim that three other state lotteries in Colorado, Wisconsin, and Oklahoma also report paying out prizes worth $8m to people associated with Tipton.
Source: Feds widen probe into lottery IT boss who rooted game for profit
Database of 191 million U.S. voters exposed on Internet
An independent computer security researcher uncovered a database of information on 191 million voters that is exposed on the open Internet due to an incorrectly configured database, he said on Monday.
The database includes names, addresses, birth dates, party affiliations, phone numbers and emails of voters in all 50 U.S. states and Washington, researcher Chris Vickery said in a phone interview.
Source: Database of 191 million U.S. voters exposed on Internet: researcher
AVG: “Web TuneUP” extension multiple critical vulnerabilities: exposes browsing history and other personal data
When a user installs AVG AntiVirus, a Chrome extension called “AVG Web TuneUp” with extension id chfdnecihphmhljaaejmgoiahnihplgn is force-installed. I can see from the webstore statistics it has nearly 9 million active Chrome users.
the attached exploit steals cookies from avg.com. It also exposes browsing history and other personal data to the internet, I wouldn’t be surprised if it’s possible to turn this into arbitrary code execution.
Springer books releases +-60k books online for free
Windows 10 uploads your Encryption Key to Microsoft with no opt-out.
One of the excellent features of new Windows devices is that disk encryption is built-in and turned on by default, protecting your data in case your device is lost or stolen. But what is less well-known is that, if you are like most users and login to Windows 10 using your Microsoft account, your computer automatically uploaded a copy of your recovery key – which can be used to unlock your encrypted disk – to Microsoft’s servers, probably without your knowledge and without an option to opt-out.
[…]
As Green puts it, “Your computer is now only as secure as that database of keys held by Microsoft, which means it may be vulnerable to hackers, foreign governments, and people who can extort Microsoft employees.”
Source: Recently Bought a Windows Computer? Microsoft Probably Has Your Encryption Key
Australian government urges holidaymakers to kill two-factor auth
The official Twitter account for myGov – a portal for accessing government services online – told Aussies this week: “Going overseas this summer? If you’re registered for myGov security codes make sure you turn them off before you go.”
The startling tweets come complete with professional cartoon graphics, clearly suggesting that rather than a civil servant going rogue on an idle afternoon, the advice was produced as a matter of policy.
Source: Australian government urges holidaymakers to kill two-factor auth
Because some people can’t receive SMS in foreign countries. This is a bad idea ™
Washington State released thousands of inmates early in error due to poor software
Gov. Jay Inslee says the Washington Department of Corrections has been making mistakes in calculating sentences since 2002, resulting in thousands of inmates leaving prison early. Corrections officials learned of the problem in 2012.
Source: ‘Totally unacceptable’: State knew thousands of inmates were released in error
This is why QA is so important!
How to log into any backdoored Juniper firewall – hard-coded password published
And that password is: <<< %s(un='%s') = %u.
Source: How to log into any backdoored Juniper firewall – hard-coded password published
