Three popular Drupal modules get patches for site takeover flaws

The security team of the popular Drupal content management system worked with the maintainers of three third-party modules to fix critical vulnerabilities that could allow attackers to take over websites.The flaws allow attackers to execute rogue PHP code web servers that host Drupal websites with the RESTWS, Coder or Webform Multiple File Upload modules installed. These modules are not part of Drupal's core, but are used by thousands of websites.The RESTWS module is a popular tool for creating Rest application programming interfaces (APIs) and is currently installed on over 5,800 websites. Unauthenticated attackers can exploit the remote code execution vulnerability in its page callback functionality by sending specially crafted requests to the website.To read this article in full or to leave a comment, please click here

Three popular Drupal modules get patches for site takeover flaws

The security team of the popular Drupal content management system worked with the maintainers of three third-party modules to fix critical vulnerabilities that could allow attackers to take over websites.The flaws allow attackers to execute rogue PHP code web servers that host Drupal websites with the RESTWS, Coder or Webform Multiple File Upload modules installed. These modules are not part of Drupal's core, but are used by thousands of websites.The RESTWS module is a popular tool for creating Rest application programming interfaces (APIs) and is currently installed on over 5,800 websites. Unauthenticated attackers can exploit the remote code execution vulnerability in its page callback functionality by sending specially crafted requests to the website.To read this article in full or to leave a comment, please click here

AT&T Open Sources Its ECOMP Platform for SDN & NFV

AT&T's SDN brains will be open to everyone.

Cisco Live: Midweek Impressions

I’m at Cisco Live this week in Las Vegas; forthwith, some observations, thoughts, and… a long rant.

First, if you’re here, look me up. I normally hang out around the Certification and/or Social areas when I’m not in meetings/etc. I’m pretty easy to find, so drop by and say hi. It’s been like old home week for me—reconnecting with people I’ve not seen in years, catching up and friendships, etc. I can’t tell you how much I appreciate the people I’ve worked with over the years in terms of friendships offered and skills learned. Seriously.

Second, I’m speaking on Thursday afternoon about understanding and managing network complexity. I’m pretty certain the session isn’t full yet, so come by and listen. It’s a 90 minute investment that could change the way you think about network design and operation. Seriously.

Third, The content seems to be deep and interesting this year, as always. This brings me to my first contrary point, though—this industry needs a show that compares with Live in depth of technical material, but isn’t tied to a particular vendor. Are you listening, Interop? I know, it’s hard to talk deep technology in the modern networking world—which leads me to Continue reading

Chinese hackers blamed for multiple breaches at US banking agency

Chinese government hackers were the likely attackers in three breaches in recent years at the Federal Deposit Insurance Corporation, the U.S. agency that insures bank accounts, according to a congressional audit.Breaches at the FDIC in 2010, 2011, and 2013 were caused by an "advanced persistent threat ... believed to have been the Chinese government," according to an interim report on the agency's cybersecurity from the House of Representatives Science, Space, and Technology Committee.In the 2013 breach, hackers gained access to the computers of 12 staff computers, including the former chairman, chief of staff and general counsel of the agency, the House report said.To read this article in full or to leave a comment, please click here

Chinese hackers blamed for multiple breaches at US banking agency

Chinese government hackers were the likely attackers in three breaches in recent years at the Federal Deposit Insurance Corporation, the U.S. agency that insures bank accounts, according to a congressional audit.Breaches at the FDIC in 2010, 2011, and 2013 were caused by an "advanced persistent threat ... believed to have been the Chinese government," according to an interim report on the agency's cybersecurity from the House of Representatives Science, Space, and Technology Committee.In the 2013 breach, hackers gained access to the computers of 12 staff computers, including the former chairman, chief of staff and general counsel of the agency, the House report said.To read this article in full or to leave a comment, please click here

Startups boldly challenge Internet, mass transit & password status quo

One startup pledged to “make passwords impossible to steal.” Another promised technology to "absolutely change the face of the Internet itself!” And an asphalt-hating CEO said his outfit’s zippy overhead pods will be a green replacement for gas guzzling vehicles in big cities within a couple of years.The 88th edition of Mass Innovation Nights on Tuesday gave the stage – at host LogMeIn’s airy Boston Seaport digs – to an idealistic handful of startups unfettered so far by venture capital and repetitive marketing lingo (I only heard the dreaded word “journey” once!). The founders eagerly answered questions posed by attendees – including precocious teens on summer break -- and collected certificates earned for winning a popular vote among audience members. To read this article in full or to leave a comment, please click here

Startups boldly challenge Internet, mass transit & password status quo

One startup pledged to “make passwords impossible to steal.” Another promised technology to "absolutely change the face of the Internet itself!” And an asphalt-hating CEO said his outfit’s zippy overhead pods will be a green replacement for gas guzzling vehicles in big cities within a couple of years.The 88th edition of Mass Innovation Nights on Tuesday gave the stage – at host LogMeIn’s airy Boston Seaport digs – to an idealistic handful of startups unfettered so far by venture capital and repetitive marketing lingo (I only heard the dreaded word “journey” once!). The founders eagerly answered questions posed by attendees – including precocious teens on summer break -- and collected certificates earned for winning a popular vote among audience members. To read this article in full or to leave a comment, please click here

Senator prods Niantic about Pokemon Go privacy and security issues

Personally, I’m just watching the Pokemon Go craze unfold; if I had considered checking it out by playing, then seeing the unbelievably long list of access permissions the app required put a stop to it immediately before installing.Although you may or may not agree that Pokemon Go is a “government surveillance psyop conspiracy” which has a “direct(-ish)” connection to the CIA, if you play the game then you better grab the latest update. Niantic claimed it pushed out “emergency fixes” since a “coding error” allowed the app to get full access to your Google account.To read this article in full or to leave a comment, please click here

Senator prods Niantic about Pokemon Go privacy and security issues

Personally, I’m just watching the Pokemon Go craze unfold. If I had considered checking it out by playing, seeing the unbelievably long list of access permissions the app required would have put a stop to it immediately before installing.Although you may or may not agree that Pokemon Go is a “government surveillance psyop conspiracy” that has a “direct(-ish)” connection to the CIA, if you play the game then you better grab the latest update. Niantic claimed it pushed out “emergency fixes” since a “coding error” allowed the app to get full access to your Google account.To read this article in full or to leave a comment, please click here

How ‘human-aware’ AI could save us from the robopocalypse

Much virtual ink gets spilled each week enumerating the many horrors that could be ours in an AI-filled world, but top researchers in the field are already thinking ahead and making plans to ensure none of that happens.In particular, the importance of making artificial intelligence "human-aware" has come to be viewed as a top imperative for the field, earning it special status as an official theme of the International Joint Conference on Artificial Intelligence taking place this week in New York.To read this article in full or to leave a comment, please click here

Glue Networks wants to be the orchestration platform for the networked world

Glue Networks used the Cisco Live conference in Las Vegas this week to announce what CEO Jeff Gray describes as the “first multi-vendor software defined network orchestration platform focused on end-to-end automation, all the way from the data center across the WAN as well as the LAN.”While Software Defined Networking promised to simplify the management of network devices by centralizing control, Gray argues the SDN tools are still vendor specific: “Juniper has their controller, Cisco has theirs, Brocade, you name it.  It’s hard enough to automate and build orchestration for a single vendor, but now customers have these different vendor islands and they need a consistent layer of automation across them to plug into their existing workflow systems, monitoring tools, ITSM workflows, IP addressing systems, etc.  That’s the gap in the network world we’re solving.”To read this article in full or to leave a comment, please click here

Glue Networks wants to be the orchestration platform for the networked world

Glue Networks used the Cisco Live conference in Las Vegas this week to announce what CEO Jeff Gray describes as the “first multi-vendor software defined network orchestration platform focused on end-to-end automation, all the way from the data center across the WAN as well as the LAN.”While Software Defined Networking promised to simplify the management of network devices by centralizing control, Gray argues the SDN tools are still vendor specific: “Juniper has their controller, Cisco has theirs, Brocade, you name it.  It’s hard enough to automate and build orchestration for a single vendor, but now customers have these different vendor islands and they need a consistent layer of automation across them to plug into their existing workflow systems, monitoring tools, ITSM workflows, IP addressing systems, etc.  That’s the gap in the network world we’re solving.”To read this article in full or to leave a comment, please click here

IDG Contributor Network: Indegy lands Series A for industrial system security

News today from Indegy that it has closed a $12 million Series A funding round led by Vertex Ventures Israel with participation from Silicon Valley-based Aspect Ventures, SBI Holdings of Japan, as well as previous investors Shlomo Kramer and Magma Venture Partners. This round takes total funding for this little-known company to some $18 million.Indegy is in the business of protecting industrial control systems (ICS). ICS may not sound sexy, but before the Internet of Things (IoT), huge industrial processes and infrastructures were controlled, monitored and maintained by large ICS networks. Unlike IoT, which tends to work on the public internet, ICS generally runs on private networks and is hence less visible to the general public. And while everyone fixates on the latest iPhone or hot dating app, they remain blissfully aware of what controls their power systems, water and sewerage systems, and large HVAC installs.To read this article in full or to leave a comment, please click here

Vicious new ransomware takes your money and still deletes your files

There’s a new form of ransomware—apparently built by amateurs—that takes your money but deletes your personal files anyway. Security research firm Talos recently published a blog post about a new form of malware dubbed Ranscam.This ransomware follows the basic premise of previous variants. It claims your files have been encrypted, and thus inaccessible to you, then threatens to delete all your files if you don’t pay up. Ransomware's scary premise prompts many people to fork over the dough in order to save their photos and other content.To read this article in full or to leave a comment, please click here

Vicious new ransomware takes your money and still deletes your files

There’s a new form of ransomware—apparently built by amateurs—that takes your money but deletes your personal files anyway. Security research firm Talos recently published a blog post about a new form of malware dubbed Ranscam.This ransomware follows the basic premise of previous variants. It claims your files have been encrypted, and thus inaccessible to you, then threatens to delete all your files if you don’t pay up. Ransomware's scary premise prompts many people to fork over the dough in order to save their photos and other content.To read this article in full or to leave a comment, please click here

Omni Hotels’ new CIO shores up cybersecurity amid data breach

New Omni Hotels & Resorts CIO Ken Barnes is mulling how to shore up corporate defense in the wake of a cybersecurity attack that impacted 48 of its 60 hotels in North America. Barnes, who started in May, of course says he plans to improve the protection for Omni's payment processing systems. New defenses could include analytics that detect anomalous behavior suggesting that a hacker has entered or is trying to enter Omni's computer network. Omni Hotels & Resorts CIO Ken Barnes.To read this article in full or to leave a comment, please click here

Malware infections drop in first half of 2016

Malware infections in the United States dropped by 47 percent in the first half of 2016 when compared to the same period last year, according to a new report by cybersecurity software provider Enigma Software. Enigma analyzed 30 million infected computers and found that while malware and ransomware infections still remained at an all-time high relative to prior years, the overall rate of infections had dropped 47.3 percent compared to the first half of 2015. + Also on Network World: 8 ways to fend off spyware, malware and ransomware +To read this article in full or to leave a comment, please click here

Facebook’s OpenCellular base stations to connect more mobile users

Facebook’s Aquila Unmanned Aircraft research project, which uses solar-powered drones to fill the internet access void in unconnected regions of the world, could be overtaken by the company’s latest development.  Facebook announced today that it will apply its open source influence and expertise to a new open-source, mobile, voice and data cellular base station called OpenCellular—a cellular base station in a box. The first implementations are expected to be available this summer.Facebook’s move represents breathtaking potential. Another company, Range Networks, has proven the feasibility of the model. Now, with Facebook’s extensive resources, this feasibility could become a reality, connecting the 4 billion not-yet-internet-connected people and the 10 percent of the world’s population who lack simple cellular voice and SMS connections.To read this article in full or to leave a comment, please click here

Digital Ocean adds block storage to cloud servers

Digital Ocean, an intriguing cloud infrastructure vendor that many may not have heard of, is taking a big step forward today with the introduction of block storage to its platform.Block storage allows users to add extra disk space to virtual machines that can be scaled up and down independently from the state of the VM. DO’s SSD-based Block Storage is priced at $.10 per GB per month, the same price as Amazon EBS, the Elastic Block Storage Service from Amazon Web Services. Digital Ocean Digital Ocean unveiled a new logo, new CTO and new Block Storage service today To read this article in full or to leave a comment, please click here