Researchers add software bugs to reduce the number of… software bugs

Researchers are adding bugs to experimental software code in order to ultimately wind up with programs that have fewer vulnerabilities.The idea is to insert a known quantity of vulnerabilities into code, then see how many of them are discovered by bug-finding tools.By analyzing the reasons bugs escape detection, developers can create more effective bug-finders, according to researchers at New York University in collaboration with others from MIT’s Lincoln Laboratory and Northeastern University.They created large-scale automated vulnerability addition (LAVA), which is a low-cost technique that adds the vulnerabilities. “The only way to evaluate a bug finder is to control the number of bugs in a program, which is exactly what we do with LAVA,” says Brendan Dolan-Gavitt, a computer science and engineering professor at NYU’s Tandon School of Engineering.To read this article in full or to leave a comment, please click here

Researchers add software bugs to reduce the number of… software bugs

Researchers are adding bugs to experimental software code in order to ultimately wind up with programs that have fewer vulnerabilities.The idea is to insert a known quantity of vulnerabilities into code, then see how many of them are discovered by bug-finding tools.By analyzing the reasons bugs escape detection, developers can create more effective bug-finders, according to researchers at New York University in collaboration with others from MIT’s Lincoln Laboratory and Northeastern University.They created large-scale automated vulnerability addition (LAVA), which is a low-cost technique that adds the vulnerabilities. “The only way to evaluate a bug finder is to control the number of bugs in a program, which is exactly what we do with LAVA,” says Brendan Dolan-Gavitt, a computer science and engineering professor at NYU’s Tandon School of Engineering.To read this article in full or to leave a comment, please click here

How to remove your Windows 10 password

Windows 10 wants you to enter your password all the time. You can remove your password, or reduce how often you have to enter one, but there are security risks to doing so.

Worth Reading: Converged systems hype

Converged systems are a hot commodity in the IT sector these days. But it looks to us like the hype over various kinds of integrated systems that weld servers and storage together into preconfigured stacks including hyperconverged stacks that literally merge the compute and storage layers on the same servers – is just a bit bigger than the appetite for such iron in the datacenters of the world. -The Next Platform

The post Worth Reading: Converged systems hype appeared first on 'net work.

IDG Contributor Network: Cajun redux? Avaya’s focus on data networking misses the mark

While channel surfing recently I landed on a reality TV show where people bid on abandoned homes without knowing what’s inside. Occasionally, something of true value is found—maybe even something that might make the new owners wealthy. One might say that something like this happened when Avaya acquired Nortel Enterprise Solutions (NES) in 2009.Comparatively, Avaya inherited rooms upon rooms where old Aunt Norty had stashed the detritus of her life. There were, however, many treasures. One find, known today as the company’s SDN Fx™ Architecture, might be compared to a Picasso found stashed away in the attic. That’s the good news.To read this article in full or to leave a comment, please click here

IDG Contributor Network: Cajun redux? Avaya’s focus on data networking misses the mark

While channel surfing recently I landed on a reality TV show where people bid on abandoned homes without knowing what’s inside. Occasionally, something of true value is found—maybe even something that might make the new owners wealthy. One might say that something like this happened when Avaya acquired Nortel Enterprise Solutions (NES) in 2009.Comparatively, Avaya inherited rooms upon rooms where old Aunt Norty had stashed the detritus of her life. There were, however, many treasures. One find, known today as the company’s SDN Fx™ Architecture, might be compared to a Picasso found stashed away in the attic. That’s the good news.To read this article in full or to leave a comment, please click here

Check this out: Walmart Pay for iOS & Android can now be used in all of retailer’s US stores

The following email subject lines appeared in my inbox on Wednesday just a couple of hours apart:* Walmart Pay Now Available in all Walmart Stores Nationwide (from Walmart PR)* Map of Walmart store closings (from a market research firm making a larger point about rapid changes in retail and consumer packaged goods markets) My first thought, upon noticing the juxtaposition, was well, having 154 fewer stores in the US this year probably made it easier for Walmart to roll out its mobile payment app nationwide.MORE: 7 reasons mobile payments still aren't mainstreamTo read this article in full or to leave a comment, please click here

Check this out: Walmart Pay for iOS & Android can now be used in all of retailer’s US stores

The following email subject lines appeared in my inbox on Wednesday just a couple of hours apart:* Walmart Pay Now Available in all Walmart Stores Nationwide (from Walmart PR)* Map of Walmart store closings (from a market research firm making a larger point about rapid changes in retail and consumer packaged goods markets) My first thought, upon noticing the juxtaposition, was well, having 154 fewer stores in the US this year probably made it easier for Walmart to roll out its mobile payment app nationwide.MORE: 7 reasons mobile payments still aren't mainstreamTo read this article in full or to leave a comment, please click here

Here’s how secret voice commands could hijack your smartphone

Kitten videos are harmless, right? Except when they take over your phone. Researchers have found something new to worry about on the internet. It turns out that a muffled voice hidden in an innocuous YouTube video could issue commands to a nearby smartphone without you even knowing it. The researchers describe the threat in a research paper to be presented next month at the USENIX Security Symposium in Austin, Texas. They also demonstrate it in this video. Voice recognition has taken off quickly on phones, thanks to services like Google Now and Apple's Siri, but voice software can also make it easier to hack devices, warned Micah Sherr, a Georgetown University professor and one of the paper’s authors.To read this article in full or to leave a comment, please click here

Here’s how secret voice commands could hijack your smartphone

Kitten videos are harmless, right? Except when they take over your phone. Researchers have found something new to worry about on the internet. It turns out that a muffled voice hidden in an innocuous YouTube video could issue commands to a nearby smartphone without you even knowing it. The researchers describe the threat in a research paper to be presented next month at the USENIX Security Symposium in Austin, Texas. They also demonstrate it in this video. Voice recognition has taken off quickly on phones, thanks to services like Google Now and Apple's Siri, but voice software can also make it easier to hack devices, warned Micah Sherr, a Georgetown University professor and one of the paper’s authors.To read this article in full or to leave a comment, please click here

Featured Article: Peek under the Hood of Telco-Grade OpenStack

Critical challenges for OpenStack in telecom debunked

Car hacking: Thieves armed with laptops are stealing cars

Thieves armed with laptops are hacking into electronic ignitions of late-model cars to steal the vehicles. Police and insurers sounded the warning to raise awareness about the latest car-theft trend.The Houston Police Department pointed at surveillance footage that shows two suspects, one of whom used a laptop, before stealing a 2010 Jeep Wrangler Unlimited. The first suspect opened the Jeep’s hood to reportedly cut the alarm. The footage below took place about 10 minutes later when a second suspect jimmied the door open, climbed inside and then did something with a laptop before stealing the Jeep. “If you are going to hot-wire a car, you don’t bring along a laptop,” Houston Police Department Officer James Woods told the Wall Street Journal. “We don’t know what he is exactly doing with the laptop, but my guess is he is tapping into the car’s computer and marrying it with a key he may already have with him so he can start the car.”To read this article in full or to leave a comment, please click here

Car hacking: Thieves armed with laptops are stealing cars

Thieves armed with laptops are hacking into electronic ignitions of late-model cars to steal the vehicles. Police and insurers sounded the warning to raise awareness about the latest car-theft trend.The Houston Police Department pointed at surveillance footage that shows two suspects, one of whom used a laptop, before stealing a 2010 Jeep Wrangler Unlimited. The first suspect opened the Jeep’s hood to reportedly cut the alarm. The footage below took place about 10 minutes later when a second suspect jimmied the door open, climbed inside and then did something with a laptop before stealing the Jeep. “If you are going to hot-wire a car, you don’t bring along a laptop,” Houston Police Department Officer James Woods told the Wall Street Journal. “We don’t know what he is exactly doing with the laptop, but my guess is he is tapping into the car’s computer and marrying it with a key he may already have with him so he can start the car.”To read this article in full or to leave a comment, please click here

New Mac backdoor program steals keychain contents

Researchers have identified a new Mac backdoor program that's designed to steal credentials stored in the OS-encrypted keychain and give attackers control over the system. Dubbed OSX/Keydnap by researchers from antivirus vendor ESET, this is the second backdoor program targeting Macs found by antivirus firms in the past few days. It's not clear how Keydnap is distributed, but it arrives on computers in the form of a zip archive. Inside there's an executable file with an apparently benign extension such as .txt or .jpg that actually has a space character at the end. The file also has an icon indicating an image or text file.To read this article in full or to leave a comment, please click here

New Mac backdoor program steals keychain contents

Researchers have identified a new Mac backdoor program that's designed to steal credentials stored in the OS-encrypted keychain and give attackers control over the system. Dubbed OSX/Keydnap by researchers from antivirus vendor ESET, this is the second backdoor program targeting Macs found by antivirus firms in the past few days. It's not clear how Keydnap is distributed, but it arrives on computers in the form of a zip archive. Inside there's an executable file with an apparently benign extension such as .txt or .jpg that actually has a space character at the end. The file also has an icon indicating an image or text file.To read this article in full or to leave a comment, please click here

Microsoft COO Kevin Turner leaves to head a financial trading company

Microsoft COO Kevin Turner is leaving after 11 years in the role. He won't be replaced.Employees learned of the move Thursday in an email message from CEO Satya Nadella, in which he outlined his plans for reorganizing the company's senior leadership team.Nadella highlighted the importance of having "one feedback loop" across the company to reinforce customer value and satisfaction. To achieve this, he said, he will more deeply integrate the sales, marketing and services group with the rest of the company, under a single senior leadership team.To read this article in full or to leave a comment, please click here

IDG Contributor Network: We touch our phones 2,617 times a day, says study

We’re obsessed with our phones, a new study has found. The heaviest smartphone users click, tap or swipe on their phone 5,427 times a day, according to researcher Dscout.That’s the top 10 percent of phone users, so one would expect it to be excessive. However, the rest of us still touch the addictive things 2,617 times a day on average. No small number.+ Also on Network World: Time for digital detox? Searching for Wi-Fi becomes normal vacation behavior +To read this article in full or to leave a comment, please click here

The Complexity Conundrum

Complexity is the enemy of understanding. Think about how much time you spend in your day trying to simplify things. Complexity is the reason why things like Reddit’s Explain Like I’m Five exist. We strive in our daily lives to find ways to simplify the way things are done. Well, except in networking.

Building On Shifting Sands

Networking hasn’t always been a super complex thing. Back when bridges tied together two sections of Ethernet, networking was fairly simple. We’ve spent years trying to make the network do bigger and better things faster with less input. Routing protocols have become more complicated. Network topologies grow and become harder to understand. Protocols do magical things with very little documentation beyond “Pure Freaking Magic”.

Part of this comes from applications. I’ve made my feelings on application development clear. Ivan Pepelnjak had some great comments on this post as well from Steve Chalmers and Derick Winkworth (@CloudToad). I especially like this one:

Derick is right. The application Continue reading

Avi Networks Webinar Demonstrates How To Supercharge your Application Services with Software-Defined Load Balancers

The Avi Vantage Platform uses a single point of service orchestration and other software-defined approaches to deliver application agility, scaling without complexity.

Code reuse exposes over 120 D-Link devices models to hacking

A recently discovered vulnerability in a D-Link network camera that allows attackers to remotely take over the device also exists in more than 120 other D-Link products.The vulnerability was initially discovered a month ago by researchers from security start-up firm Senrio in D-Link DCS-930L, a Wi-Fi enabled camera that can be controlled remotely through a smartphone app.The flaw, a stack overflow, is located in a firmware service called dcp, which listens to commands on port 5978. Attackers can trigger the overflow by sending specifically crafted commands and then can execute rogue code on the system.To read this article in full or to leave a comment, please click here