Microsoft to pay up to US$15K for bugs in two Visual Studio tools

Microsoft has started a three-month bug bounty program for two tools that are part of Visual Studio 2015.The program applies to the beta versions of Core CLR, which is the execution engine for .NET Core, and ASP.NET, Microsoft's framework for building websites and web applications. Both are open source."The more secure we can make our frameworks, the more secure your software can be," wrote Barry Dorrans, security lead for ASP.NET, in a blog post on Tuesday.All supported platforms that .NET Core and ASP.NET run on will be eligible for bounties except for beta 8, which will exclude the networking stack for Linux and OS X, Dorrans wrote.To read this article in full or to leave a comment, please click here

Researchers warn computer clocks can be easily scrambled

In 2012, two servers run by the U.S. Navy rolled back their clocks 12 years, deciding it was the year 2000.The servers were very important: they're part of a worldwide network that helps computers keep the right time using the Network Time Protocol (NTP).Computers that checked in with the Navy's servers and adjusted their clocks accordingly had a variety of problems with their phones systems, routers and authentication systems.The incident underscored the serious problems that can occur when using NTP, one of the oldest Internet protocols published in 1985.The protocol is fairly robust, but researchers from Boston University said on Wednesday they've found several flaws in NTP that could undermine encrypted communications and even jam up bitcoin transactions.To read this article in full or to leave a comment, please click here

Researchers warn computer clocks can be easily scrambled

In 2012, two servers run by the U.S. Navy rolled back their clocks 12 years, deciding it was the year 2000.The servers were very important: they're part of a worldwide network that helps computers keep the right time using the Network Time Protocol (NTP).MORE: 10 Cool Network & Computing Research ProjectsComputers that checked in with the Navy's servers and adjusted their clocks accordingly had a variety of problems with their phones systems, routers and authentication systems.To read this article in full or to leave a comment, please click here

Biden vs Risk Analysis

What we try to do in cybersecurity is "risk analysis". Most people get this wrong.

An example of this is today's announcement by vice president Joe Biden that he won't run for president. Many pundits have opined that it's because he can't beat Hillary Clinton. This is wrong.

The phrase "can't beat Hillary" makes no sense. It imagines a world were risk is binary, you either can or you can't. That's not how it work. Instead, we calculate the odds of beating Hillary. That number is not 0%. For one thing, a meteor might hit the earth and strike Hillary dead, so there's always some chance of beating her.

Responsible risk analysts ignore the rhetoric and try to calculate the odds. The easiest way of doing this are on the many betting websites, which have variously given Biden a 5% to 10% of winning the presidency. Given that the presidency is easily worth a billion dollars, and you don't spend your own money (just donations), these are great odds. Everybody who believes their chance is greater than 5% runs -- which is why we have over 20 candidates right now.

In other words, would you pay $10 for a 5% Continue reading

Synack builds intel platform for its penetration testers

Synack, a security company that uses crowdsourcing for penetration testing, has built an intelligence platform that it says will narrow down weak points in a company's network. Based in Redwood City, California, Synack uses a network of freelance security analysts in 35 countries to probe the networks of companies who've signed up to its subscription service. The analysts, who are closely vetted by Synack, get paid based on the vulnerabilities and security problems they find, ranging from $100 up to thousands. The subscription offering means companies are continually analyzed. Jay Kaplan, Synack's co-founder and CEO, said they wanted to build platform that would help its analysts quickly focus their attention on potential trouble spots. Called Hydra, the platform spots vulnerabilities in networks and applications, looks for out-of-date software and other issues.To read this article in full or to leave a comment, please click here

IDG Contributor Network: How much is your stolen personal data worth?

Examples of the different kinds of personal data available online, as well as its value on the black market, is available in a new report (PDF) from Intel Security's McAfee Labs. The report looks at pricing for credit cards, bank account login details, and other stolen personal information.$5 credit card numbers U.S. credit card account numbers complete with date of birth typically run $15, the report says. Basic card numbers without the extra data costs as little as $5."A digital equivalent of physical card would let a criminal buy things until the victim contacts the card issuer and challenge the charges," Raj Samani, CTO for Intel Security in Europe, the Middle East, and Africa, said in a McAfee blog post about the report.To read this article in full or to leave a comment, please click here

Image too good to be true? DARPA program targets image doctoring

It isn’t hard for just about anyone to change or alter an image these days -- and that can be a problem.It’s an issue researchers at the Defense Advanced Research Projects Agency want top put to rest with a new program called Media Forensics or MediFor, which looks to build an algorithmic-based platform that can detect image manipulation.+More on Network World: Gartner: Get onboard the algorithm train!“The forensic tools used today lack robustness and scalability and address only some aspects of media authentication; an end‐to‐end platform to perform a complete and automated forensic analysis does not exist. Although there are a few applications for image manipulation detection in the commercial sector, they are typically limited to a yes/no decision about the source being an “original” asset, obtained directly from an imaging device. As a result, media authentication is typically performed manually using a variety of ad hoc methods that are often more art than science, and forensics analysts rely heavily on their own background and experience,” DARPA stated.To read this article in full or to leave a comment, please click here

EU fines optical drive cartel $132M for colluding against Dell and HP

Buyers of Dell and Hewlett-Packard PCs may have paid over the odds for their optical drives as a result of a cartel arrangement between eight component manufacturers.The European Commission fined the eight cartel members a total of €116 million (US$132 million) for colluding between 2004 and 2008 to fix the prices of bids to supply optical drives to Dell and HP.Philips, Lite-On and their joint venture Philips & Lite-On Digital Solutions got away scot-free for their role in revealing the cartel. Had they not turned in their co-conspirators, they would have had to pay fines totalling €64 million between them.But the other five member, Hitachi-LG Digital Storage, Toshiba Samsung Storage Technology, Sony, Sony OptiArc and Quanta Storage, must together pay €116 million, with Hitachi-LG and Toshiba Samsung paying the largest shares.To read this article in full or to leave a comment, please click here

Adding an Interface to an OpenStack Instance After Creation

In this post I’ll share a few commands I found for adding a network interface to an OpenStack instance after launching the instance. You could, of course, simply launch the instance with multiple network interfaces from the very beginning, but these commands are handy in case you messed up or in case the requirements for the instance changed after it was launched. Please note there’s nothing revolutionary or ground-breaking in the commands listed here; I’m simply trying to help share information in the event others will find it useful.

I tested these commands using OpenStack “Juno” with VMware NSX providing the networking functionality for Neutron, but (as you can tell if you check the articles in the “References” section) this functionality has been around for a while. These commands should work with any supported Neutron plug-in.

First, create the Neutron network port:

neutron port-create <Neutron network name>

If you want to attach a security group to the port (probably a good idea), then modify the command to look like this:

neutron port-create --security-group <Security group name> 
<Neutron network name>

Note that you can add multiple --security-group parameters to the command in order to specify multiple security groups on the Continue reading

IoT security threats and how to handle them

Smart TVs in conference rooms. Brainy heating and air-conditioning systems. Internet-connected light bulbs. Intelligent devices controlling manufacturing processes. Smart watches and fitness devices everywhere. These are just a few of the things you’ll find in the enterprise Internet of Things (IoT) landscape, a landscape in which almost every physical object, it seems, has plenty of smarts and connects to networks -- and leaves enterprises vulnerable to hacks and data breaches. Also in this series... - Surveys Say: IoT dangers are here, they're real, and they're widespread - IoT Bookshelf: Essential reading for Internet of Things securityTo read this article in full or to leave a comment, please click here(Insider Story)

IoT dangers are here, they’re real, and they’re widespread

Two studies, one from HP, and one from DNS and security vendor OpenDNS, took a look at the dangers IoT devices pose, and both concluded the same thing: They’re real, they’re here, and they’re more widespread than you might imagine. Following are summaries of each study. Also in this series... - IoT security threats and how to handle them - IoT Bookshelf: Essential reading for Internet of Things securityTo read this article in full or to leave a comment, please click here(Insider Story)

1 … 3,132 3,133 3,134 3,135 3,136 … 3,696