Sunday, October 1, 2006

Intel and Symantec Push Security Into Firmware. Intel and Symantec Push Security Into Firmware. 'Virtual security solution' is designed to slow virus and malware attacks. PC World: Latest Technology News] 1:46:51 AM  PermaLink   / trackback []

Security Fix Pop Quiz: Have You Been Patching? Security Fix Pop Quiz: Have You Been Patching? It's that time again Security Fix readers: A pop quiz to see how well you've been keeping up with software security updates for some of the more commonly installed deskop applications. Below are a few of the more important updates, including first links to the newest versions followed by Security Fix analysis: AOL 9.0 Security Edition -- Advisory issued Sept. 13 Quicktime 7.1.3 -- Released Sept. 12 Java Runtime Environment (JRE) 5.0 Update 8 -- Released Aug. 29 Macromedia Flash Player v9.0.16.0 -- Released June 28 Winamp v. 5.24 -- Released June 26 Adobe Reader v. 7.0.8 -- Released June 15 RealPlayer, RealOne Player and RealJukebox updates -- Released March 22 How'd you do on the quiz? It's not too late to download these updates now. [Security Fix] 1:40:06 AM  PermaLink   / trackback []

Snooping on Your Online Searches. Snooping on Your Online Searches. SAN DIEGO -- America Online took a lot of heat recently for disclosing what hundreds of thousands of AOL users had searched for online, but the truth is that stealing search results from any Internet user is well within the reach of all Web site owners, according to research published this week. Atlanta-based security vendor SPI Dynamics released a white paper showing just how easy it is for a Web site owner to mine the recent search queries of anyone visiting the site just by using fairly simple Javascript code. Javascript is a very powerful cross-platform programming language deployed on millions of Web sites, but it can also be an incredibly invasive tool in the hands of bad guys, as research presented at this year's Black Hat hacker conference made painfully clear. Basing much of its research on that Black Hat talk, SPI Dynamics found that it is fairly easy for a Web site to use Javascript to check whether a visitor recently searched for a pre-defined list of phrases and/or words. To see this concept in action, navigate to Google.com and then run a search for a word or phrase. Then visit SPI Dynamics' proof-of-concept page, and type in the exact same word or phrase you entered at Google. The SPI page should return the same result you searched for in Google. This exploit is somewhat limited, in that it requires the snooping Web site to establish a Web page with Javascript code that is already set up to mine a pre-defined set of search terms. But consider how powerful such a tool could be in the hands of a major online retailer, which might want to serve you ads for certain types of products based on the products you've been searching for online. More insidiously, consider a government Web site that queries whether you've searched for certain terms that might make you a target for further investigation, such as "porn," "bomb making," or certain types of illicit drugs. There are plenty of permutations and different scary scenarios for this type of attack. And this exploit is not limited to Google, as a review of the source page for SPI's exploit shows. In theory, a Web site could use Javascript to query all kinds of information the user enters into a text form field or search engine. In my experience, turning Javascript off in Internet Explorer tends to lead to kludgy results when browsing many sites, but I've come to love the "noscript" browser plugin or extension for Firefox, which blocks all Javascript by default and lets you decide which sites you trust to allow Javascript code. Obviously, that extension is not a foolproof approach, as even a site that you've marked safe for Javascript in Firefox could turn around and later use the code to probe your search results (or worse), but it's better than nothing. [Security Fix] 12:37:17 AM  PermaLink   / trackback []

House Passes Worst Version of Wilson NSA Bill. House Passes Worst Version of Wilson NSA Bill. The full House of Representatives on Thursday passed a version of Rep. Heather Wilson's (R-N.M.) warrantless wiretapping bill (H.R. 5825) that includes the worst elements of earlier versions of the bill approved by the House Judiciary and Intelligence Committees. The vote was 232-191. CDT opposes this bill and its counterpart in the Senate, the Specter-Cheney bill. [Center for Democracy and Technology] 12:33:21 AM  PermaLink   / trackback []

HP 'routinely' uses email tracking. HP 'routinely' uses email tracking. Web bug uncovered under Congressional spotlight Congressional hearings have revealed how HP made controversial use of email tracking technology in an attempt to identify the source of a board-level mole. [...] "I agree there's a difference between legal and ethical," he added. Use of the controversial email tracker approach by HP was far from isolated, it later emerged. Fred Adler, HP's head of information technology security, testified that HP had used the technique dozens of times in the course of previous investigations into employees and others to tackle "issues such as theft, and assisting law enforcement", Dow Jones Marketwatch reports. Adler added that use of the technique was still authorised, News.com (which explains how the ReadNotify service work in some depth) adds.  [The Register - Internet and Law: Digital Rights/Digital Wrongs] 12:17:32 AM  PermaLink   / trackback []

File-sharing software firm loses US case. File-sharing software firm loses US case. Another one bites the dust Another file-sharing software maker has been found guilty of causing copyright infringement. A US judge has said the Morpheus software produced by StreamCast breaks the law. [The Register - Internet and Law: Digital Rights/Digital Wrongs] 12:09:02 AM  PermaLink   / trackback []

House Passes Spying Bill. House Passes Spying Bill. Late last night, the House endorsed, by a vote of 232-191, a measure that legalizes the current NSA warrantless surveillance program, but it is unlikely to be sent to the president's desk before the midterm elections, according to the AP. A corresponding measure in the Senate may get a vote sometime today or tomorrow, before the Senate recesses. But since Senator Arlen Specter's bill in the Senate and Congresswoman Heather Wilson's House bill differ on enough key matters, that there is no time to reconcile the bills and resubmit them for votes by both houses. The votes are likely to be used, however, as leverage in campaign fights in the midterm elections, and depending on the outcome of those elections, could become law when Congress returns in the lame duck session after the election. Photo: hjl [27B Stroke 6] 12:07:20 AM  PermaLink   / trackback []

Judge Refuses to Stay Order Shutting Down NSA Program. Judge Refuses to Stay Order Shutting Down NSA Program. Federal judge Anna Diggs Taylor, who last month ruled that the NSA's warrantless wiretapping program was illegal and must immediately be shut down, refused to grant the government to continue the program while it asks a higher court to review her decision, according to Bloomberg. Instead, the government has one week to ask the Sixth Circuit appeals court to issue the stay. Taylor said that to prevent possible harm to the public she wouldn't order the surveillance stopped immediately, instead giving the government a week to get a federal appeals court order allowing continued surveillance. The government filed that request following the hearing. An immediate stop to the program would harm U.S. security, a government lawyer told the judge. "The terrorism surveillance program was authorized to close a gap in intelligence,'' Justice Department attorney Anthony J. Coppolino told Taylor. "A chilling effect on a small number of communicators speaking with al-Qaeda or suspected al-Qaeda does not outweigh the harm'' to the public if the program stops, he said. It is highly likely that the Sixth Circuit will reverse this decision, allowing the warrantless eavesdropping to continue until it rules on Digg Taylor's August decision.   [27B Stroke 6] 12:01:32 AM  PermaLink   / trackback []