Not only is President Barack Obama wanting assistance from tech firms to fight terrorism, as he plans to “urge hi-tech and law enforcement leaders to make it harder for terrorists to use technology to escape from justice,” but in his address late Sunday he proposed several steps that Congress should take now to defeat ISIS.That is likely to include a fresh wave of stale arguments against encryption and for NSA bulk collection power which were rehashed in the wake of recent terrorist attacks. Yet presidential hopeful Senator Rand Paul told CNN, “There will always be authoritarians like [New Jersey Gov. Chris] Christie who want you to give up your liberty for a false sense of security.”To read this article in full or to leave a comment, please click here
Researchers at the Defense Advanced Research Projects Agency want to build extremely small light detection and ranging (LIDAR) systems -- which use light to image objects and their motions like RADAR systems use radio waves – to enable a host of new applications that would let high-tech systems “see” as they never have before.+More on Network World: The world’s most popular Instagram shots+According to DARPA, a LIDAR system beams light out and then precisely monitors the timing of reflections back to map and track objects within its detection range. Unlike a camera that captures a two-dimensional rendition of three-dimensional scenes, a LIDAR system essentially captures full-fledged three-dimensional reality. The basic technology already is out there—LIDAR allowed many robots at the DARPA Robotics Challenge to “see” and it enables autonomous vehicles to sense obstacles in their surroundings, for example—but those systems are too big, heavy and expensive for widespread use, the agency stated.To read this article in full or to leave a comment, please click here
Google has released a new batch of security fixes for its Nexus smartphones and tablets, addressing flaws that could allow attackers to compromise the Android devices via rogue emails, Web pages, and MMS messages.Firmware updates are being rolled out to supported Nexus devices as an over-the-air update and the patches will be added the Android Open Source Project (AOSP) over the next 48 hours. Builds LMY48Z and Android Marshmallow with a Dec. 1, 2015, Security Patch Level contain these fixes, Google said in its security bulletin.The updates address five vulnerabilities rated as critical, 12 rated as high and two as moderate. A significant number of flaws were again located in the OS' media processing components, which handle audio and video file playback and corresponding file metadata parsing.To read this article in full or to leave a comment, please click here
Big money2015 was a big year for mergers and acquisitions in the networking industry. Here are the ones that are most likely to have the biggest long-term impact on the industry.Check Point Software acquires Hyperwise and LacoonAlthough these were small acquisitions (both in the $80 million range), they were notable as Check Point rarely makes acquisitions. Check Point has been one of the leaders in combatting threats that go through a firewall, but more hackers are now finding ways to get around perimeter security. These acquisitions help Check Point’s customers fight the security fight on other fronts.To read this article in full or to leave a comment, please click here
The number of vulnerabilities discovered in technical support applications installed on PCs by manufacturers keeps piling up. New exploits have been published for flaws in Lenovo Solution Center, Toshiba Service Station and Dell System Detect.The most serious flaws appear to be in Lenovo Solution Center and could allow a malicious Web page to execute code on Lenovo Windows-based computers with system privileges.The flaws were discovered by a hacker who uses the online aliases slipstream and RoL and who released a proof-of-concept exploit for them last week. This prompted the CERT Coordination Center at Carnegie Mellon University to publish a security advisory.To read this article in full or to leave a comment, please click here
French police have made their Christmas wish-list, and it includes banning Tor and public Wi-Fi.As legislators debate new antiterrorism laws, police and security services have been studying how technology hinders their enquiries, according to French newspaper Le Monde.In the hours following the Nov. 13 terrorist attacks in Paris the French government declared a state of emergency, granting police sweeping powers to impose curfews and conduct warrantless searches.A week later, legislators voted to extend the state of emergency from 12 days to three months, and extended police power of search to include the contents of electronic devices and cloud services accessible from them.To read this article in full or to leave a comment, please click here
According to a new report by Trend Micro, the North American cyber criminal underground isn't buried as deep as in other geographies."It doesn't exist in the dark web as much as other undergrounds do, or practice as much security," said Tom Kellermann, chief cybersecurity officer at Trend Micro. "Essentially, it's become a gun show for everyone as long as they can participate and are willing to pay."In addition to offering guns, as well as murder for hire, there's also drugs, money laundering, bullet-proof hosting, and hacking services available.MORE ON NETWORK WORLD: 26 crazy and scary things the TSA has found on travelers
It's a bonanza of services and capabilities, he said, allowing traditional criminals and organized crime groups to become cyber-capable.To read this article in full or to leave a comment, please click here
FireEye says it has discovered a type of malware designed to steal payment card data that can be very difficult to detect and remove.
The cybercriminal group behind the malware, which FireEye nicknamed "FIN1," is suspected of being in Russia and has been known to target financial institutions.
The malware, which FIN1 calls Nemesis, infected an organization that processes financial transactions, which FireEye did not identify.
Payment card data is highly sought after by cybercriminals, who have in recent years targeted very large organizations that handle card data. Target, Home Depot and many others have reported large data breaches over the years. Some payment processors were also hit.To read this article in full or to leave a comment, please click here
In 2013, we reviewed six password managers, some suitable for enterprises and some primarily for consumers. The field has exploded and today there are more than two dozen products on the market. Even the popular TV show “Shark Tank” recently evaluated a password manager startup.But this level of activity doesn’t necessarily indicate quality. We found that some of the products we reviewed two years ago haven’t improved as much as they could have. And some of the newer products are still a work in progress.Password managers are an important first step for organizations that want to strengthen their security by helping users cope with multiple logins. While browsers have gotten more intelligent about storing passwords and synchronizing them across different platforms, you might want to have more control over the way your users manage passwords, which is where these tools come into play. Password managers are often seen as a less expensive and easier to implement solution than single sign-on products, which we’ve also reviewed.To read this article in full or to leave a comment, please click here(Insider Story)
The password is ....Image by ThinkstockPassword managers are an important first step for organizations that want to strengthen their security by helping users cope with multiple logins. In this review, we looked at 10 tools: Dashlane for Business, Keeper Security Enterprise, LastPass Enterprise (now part of LogMeIn), Lieberman Enterprise Random Password Manager, LogMeOnce Enterprise Edition, Manage Engine Password Pro, Agilebits1Password for Teams, StickyPassword, SplashID TeamsID, and SingleID. Here are the individual reviews. See the full review along with a related story on how to evaluate password managers.To read this article in full or to leave a comment, please click here
New products of the weekOur roundup of intriguing new products. Read how to submit an entry to Network World's products of the week slideshow.OOB Console Access & Remote 240VAC RebootKey features: Out-of-Band access to console ports plus OOB reboot control for managing network applications at inaccessible equipment sites. Features dual power inlets and built in ATS, plus monitoring and alarm functions. More info.To read this article in full or to leave a comment, please click here
U.S. President Barack Obama is seeking the help of tech companies to combat terror threats, which he described as entering a new phase.
Obama's remarks could put into sharp focus again the demand by law enforcement agencies for tech companies to provide ways for the government to be able to access encrypted communications.
In an address late Sunday from the Oval Office, Obama said he "would urge hi-tech and law enforcement leaders to make it harder for terrorists to use technology to escape from justice."To read this article in full or to leave a comment, please click here
Veracode released a new report, State of Software Security: Focus on Application Development, which is a supplement to the original 2015 State of Software Security (SOSS) report that was released in June. The company’s fall 2015 SOSS edition looks at security flaws of apps written in mobile app development languages, compiled languages and traditional web app development languages.To read this article in full or to leave a comment, please click here
Privacy issues will likely stay at the forefront of the FTC's focus next year thanks to the commission's appointment of Lorrie Cranor as its new chief technologist.Cranor, who is currently a professor of computer science and engineering and public policy at Carnegie Mellon University, directs the CyLab Usable Privacy and Security Laboratory. She will succeed Ashkan Soltani, the privacy expert who assumed the role in November 2014, the U.S. Federal Trade Commission announced on Thursday.Cranor will join the FTC in January.To read this article in full or to leave a comment, please click here
A Russian cyberespionage group known as Pawn Storm has adopted new tools in an ongoing attack campaign against defense contractors with the goal of defeating network isolation policies.Pawn Storm, also known as Sofacy, after its primary malware tool, has been active since at least 2007 and has targeted governmental, security and military organizations from NATO member countries, as well as media organizations, Ukrainian political activists and Kremlin critics.Since August, the group has been engaged in an ongoing attack campaign focused on defense contractors, according to security researchers from Kaspersky Lab.During this operation, the group has used a new version of a backdoor program called AZZY and a new set of data-stealing modules. One of those modules monitors for USB storage devices plugged into the computer and steals files from them based on rules defined by the attackers.To read this article in full or to leave a comment, please click here
An ongoing attack campaign combines a very effective password stealer, the most widespread exploit kit, called Angler, and the latest version of the infamous CryptoWall file-encrypting ransomware program.The attackers first use the Pony computer Trojan to pilfer passwords from compromised computers, including FTP and SSH credentials that webmasters use to administer websites, according to researchers from Heimdal Security.The stolen credentials are then used to inject malicious code into legitimate websites with the goal of redirecting their visitors to an installation of the Angler exploit kit. This is a Web-based attack tool that includes exploits for various vulnerabilities in Windows and browser plug-ins, such as Flash Player and Java.To read this article in full or to leave a comment, please click here
A three-year-old vulnerability in a software component used in millions of smart TVs, routers and phones still hasn't been patched by many vendors, thus posing a risk, according to Trend Micro.Although a patch was issued for the component in December 2012, Trend Micro found 547 apps that use an older unpatched version of it, wrote Veo Zhang, a mobile threats analyst."These are very popular apps that put millions of users in danger; aside from mobile devices, routers, and smart TVs are all at risk as well," he wrote.To read this article in full or to leave a comment, please click here
Microsoft said Thursday it aided law enforcement agencies in several regions to disrupt a four-year-old botnet called Dorkbot, which has infected one million computers worldwide.The Dorkbot malware aims to steal login credentials from services such as Gmail, Facebook, PayPal, Steam, eBay, Twitter and Netflix.It was first spotted around April 2011. Users typically get infected by browsing to websites that automatically exploit vulnerable software using exploit kits and through spam. It also has a worm functionality and can spread itself through through social media and instant messaging programs or removable media drives.Microsoft didn't provide much detail on how Dorkbot's infrastructure was disrupted. The company has undertaken several such actions over the last few years in cooperation with law enforcement.To read this article in full or to leave a comment, please click here
Let's Encrypt, the project offering free digital certificates for websites, is now issuing them more broadly with the launch of a public beta on Thursday.The beta label will eventually be dropped as the software they've developed is refined, wrote Josh Aas, executive director of the Internet Security Research Group (ISRG), which runs Let's Encrypt."Automation is a cornerstone of our strategy, and we need to make sure that the client works smoothly and reliably on a wide range of platforms," he wrote.Digital certificates use the SSL/TLS (Secure Sockets Layer/Transport Layer Security) protocols to encrypt traffic exchanged between a user and a service, adding a higher level of privacy and security.To read this article in full or to leave a comment, please click here
Some members of Congress apparently think that by passing a law, they can beat ticket bots.The response of IT experts: Good luck with that.The intentions are the best, of course. Companion bills now pending in the House and Senate are aimed at stopping online ticket scalpers by banning the use of bots – software that can buy hundreds or even thousands of tickets or reservations before the average individual buyer even gets started.But a law isn’t going to stop the scalpers, according to experts including Rami Essiad, cofounder and CEO of Distil Networks. “You’re trying to combat an enemy you can’t see,” he said. “Making it illegal doesn’t allow you to see them. There’s a lot of legislation saying it’s illegal to hack, but there’s plenty of hacking still going on.”To read this article in full or to leave a comment, please click here