Large-scale Google malvertising campaign hits users with exploits

A large number of ads distributed by a Google advertising partner redirected users to Web-based exploits that attempted to install malware on users’ computers.Security researchers from Dutch security firm Fox-IT observed the malvertising campaign Tuesday, when ads coming through a Google partner in Bulgaria called Engage Lab started redirecting users to the Nuclear Exploit Kit.Exploit kits are Web-based attack platforms that try to exploit vulnerabilities in browsers and browser plug-ins in order to infect users’ computers with malware. The Nuclear Exploit Kit specifically targets vulnerabilities in Adobe Flash Player, Oracle Java and Microsoft Silverlight.To read this article in full or to leave a comment, please click here

The Upload: Your tech news briefing for Wednesday, April 8

Microsoft will offer a peek at new Office apps next weekA Microsoft event on April 16 promises an advance look at how the next version of Office will work with Windows 10, PC World reports. Demonstrations are expected to include applications that run across all platforms from mobile to desktop, and some new features in Office 2016, optimized for a touch interface.Intel shrinking RealSense 3D cameraIntel has shrunk its RealSense 3D camera and is in China pitching it to smartphone makers. In Shenzhen on Wednesday, CEO Brian Krzanich showed off a 6-inch prototype phone built with the new camera, which will be available in devices later this year.To read this article in full or to leave a comment, please click here

NAS shoot-out: QNAP vs. Synology

The past few years have seen a meteoric rise in the breadth and scope of small-business NAS, and while the top names in this space may have brought the core disciplines of NAS and even SAN to maturity, they continue to add features to their hardware. The latest from QNAP and Synology -- two longtime leaders in this market -- showcase this trend.To read this article in full or to leave a comment, please click here(Insider Story)

LG wants your help to hype its G4 smartphone

LG Electronics is recruiting an army of social media users to test and talk up the company’s new G4 smartphone ahead of its official launch on April 28.By offering 4,000 people a G4 for 30 days, the company hopes to create some buzz around its new device as flagship devices from its rivals Samsung Electronics and HTC go on sale.The Consumer Experience Campaign kicks off in South Korea on Wednesday, and will then expand to Turkey, Indonesia, Singapore, U.S., China, India, Brazil, Canada, U.K., France, Germany, Mexico, Japan and Hong Kong, LG said.Exactly how the company will choose the testers is unclear, but interested users are encouraged to check local LG webpages and social media sites in the coming days for more details on how to participate. The chosen will be given a G4 for up to 30 days, it said.To read this article in full or to leave a comment, please click here

Automate All The Things? Maybe Not

I’m fundamentally lazy. That’s why automation appeals: less work for me. Get the machine to do it instead. But automating everything isn’t always the right answer. Sometimes you need to ask yourself: Does this task need to be done at all? Or can I get someone else to do it for me?

Automating tasks carries some overhead. If you’re really unlucky, you’ll end up spending more time on the automation than doing it manually:

So if you can eliminate tasks, you’re in a much better position. Here’s a few contrived examples, based around a fictitious email provider:

Eliminating Tasks: Maximum Email Size for ‘Special’ Users

15-20 years ago we had limited bandwidth, and limited storage. It seemed reasonable to limit the maximum email message size. Otherwise people would send monstrous 2MB attachments. Of course, there were always ’special’ cases that needed to be able to send enormous 5MB AVI files. So we had special groups of users defined that could send large emails.

Users could put in a request to the Help Desk to get access to send large emails. That would go via some manager, who would of course approve it. Someone would then need to manually update that Continue reading

New Webinar: vSphere 6 Networking Deep Dive

The VMware Networking Deep Dive webinar was getting pretty old and outdated, but I always managed to get an excuse to postpone its refresh – first it was lack of new features in vSphere releases, then bad timing (doesn’t make sense to do a refresh in June with new release coming out in August), then lack of documentation (vSphere 6 was announced in August 2014; the documentation appeared in March 2015).

Read more ...

Intel shrinks RealSense camera, targets smartphones

Intel plans to cut the fat from its RealSense 3D camera so that it can fit the device on a smartphone.The company’s CEO Brian Krzanich showed off Wednesday in Shenzhen, China a 6-inch prototype phone built with the new camera, which is about half the size of the older version. The company plans to start deploying the technology this year.The U.S. chipmaker has been wanting to bring RealSense to PCs and tablets, but with the smaller size it can also deliver it to smartphones, Krzanich said. Devices built with the 3D camera could offer gesture control like Microsoft’s Kinect device.“So you can imagine the efficiencies and the opportunities and the options for innovation we have moving together,” he added.To read this article in full or to leave a comment, please click here

Intel shrinks RealSense camera, targets smartphones

Intel plans to cut the fat from its RealSense 3D camera so that it can fit the device on a smartphone.The company’s CEO Brian Krzanich showed off Wednesday in Shenzhen, China a 6-inch prototype phone built with the new camera, which is about half the size of the older version. The company plans to start deploying the technology this year.The U.S. chipmaker has been wanting to bring RealSense to PCs and tablets, but with the smaller size it can also deliver it to smartphones, Krzanich said. Devices built with the 3D camera could offer gesture control like Microsoft’s Kinect device.“So you can imagine the efficiencies and the opportunities and the options for innovation we have moving together,” he added.To read this article in full or to leave a comment, please click here

US drug enforcement amassed bulk phone records for decades

The U.S. started keeping from 1992 records of international phone calls made by Americans, under a joint program of the Department of Justice and the Drug Enforcement Administration, according to a newspaper report.The secret program, which aimed to counter drug trafficking, collected logs of ”virtually all telephone calls” from the U.S. to as many as 116 countries linked to drug trafficking, according to USA Today, which quoted current and former officials associated with the operation. But the content of the calls was not recorded as part of the collection.To read this article in full or to leave a comment, please click here

FBI says supposed ISIS sympathizers exploiting WordPress plugins

The Federal Bureau of Investigation warned Tuesday that attackers claiming to be sympathetic to the extremist group ISIS are targeting websites that have vulnerable WordPress plugins.The content management system has a thriving community of third-party developers who have created some 37,000 plugins, but occasionally security vulnerabilities in one can put a large number of websites at risk.The vulnerabilities can allow the hackers to gain unauthorized access, inject scripts or install malware on the affected sites, according to an advisory published by the FBI’s Internet Crime Complaint Center. The attackers have hit news organizations, religious institutions, commercial and government websites.To read this article in full or to leave a comment, please click here

No, 75% are not vulnerable to Heartbleed

A little-known company "Venafi" is suddenly in the news implying 75% of major systems are still vulnerable to Heartbleed. This deserves a rating of "liar liar pants on fire".

The issue isn't patches but certificates. Systems are patched, but while they were still vulnerable to Heartbleed, hackers may have stole the certificates. Therefore, the certificates need to be replaced. Not everyone has replaced their certificates, and those that have may have done so incorrectly (using the same keys, not revoking previous).

Thus, what the report is saying is that 75% haven't properly updated their certificates correctly. Naturally, they sell a solution for that problem.

However, even this claim isn't accurate. Only a small percentage of systems were vulnerable to Heartbleed in the first place, and it's hard to say which certificates actually needed to be replaced.

That's why you have the weasely marketing language above. It's not saying 3 out of 4 of all systems, but only those that were vulnerable to begin with (a minority). They aren't saying they are still vulnerable to Heartbleed itself, but only that they are vulnerable to breach -- due to the certificates having been stolen.

The entire report is so full of this Continue reading

SingTel acquires TrustWave for managed security services

SingTel will acquire TrustWave Holdings, the largest U.S. independent provider of managed security services, for $810 million, the companies said on Tuesday.SingTel, a large operator based in Singapore, owns stakes in mobile companies in Indonesia, the Philippines, Thailand, Bangladesh, India, Sri Lanka and countries in Africa. In Australia, SingTel runs Optus, one of the country’s major operators.Chicago-based TrustWave specializes in managed security services, an increasingly popular option for businesses. They allow customers turn over to a third party their network security, vulnerability management and data breach responsibilities, so they don’t have to develop those capabilities in house. As computer security has become increasingly complicated, managed security services are often are cheaper, and can allow companies to respond to security breaches faster.To read this article in full or to leave a comment, please click here

SingTel acquires TrustWave for managed security services

SingTel will acquire TrustWave Holdings, the largest U.S. independent provider of managed security services, for $810 million, the companies said on Tuesday.SingTel, a large operator based in Singapore, owns stakes in mobile companies in Indonesia, the Philippines, Thailand, Bangladesh, India, Sri Lanka and countries in Africa. In Australia, SingTel runs Optus, one of the country’s major operators.Chicago-based TrustWave specializes in managed security services, an increasingly popular option for businesses. They allow customers turn over to a third party their network security, vulnerability management and data breach responsibilities, so they don’t have to develop those capabilities in house. As computer security has become increasingly complicated, managed security services are often are cheaper, and can allow companies to respond to security breaches faster.To read this article in full or to leave a comment, please click here

Russian hackers accessed White House email, report says

Hackers working for the Russian government were able to access President Obama’s email system inside the White House, CNN reported Tuesday, indicating that an earlier breach may have been more serious than previously thought.The State Department and the White House said late last year they had seen suspicious activity in their networks, though the White House said at the time only unclassified systems were affected. That may have been true, but it understated the sensitivity of the information accessed, CNN reported Tuesday, citing unnamed U.S. officials briefed on the investigation.To read this article in full or to leave a comment, please click here

Starting OVSDB and vSwitchd in OpenvSwitch with Debugging Enabled

Here are some quick notes on how I went about debugging OVSDB (ovsdb-server) and OVS vSwitchd (ovs-vsctl). There are lots of ways to debug OVS these are what I used to get debug logs generated. Those logs are helpful troubleshooting for OVSDB transactions and OpenFlow commands when using the ovs-vctl or OVSDB and OpenFlow APIs. Dont do this unless you ... The post Starting OVSDB and vSwitchd in OpenvSwitch with Debugging Enabled appeared first on NetworkStatic | Brent Salisbury's Blog.

...
1 … 3,480 3,481 3,482 3,483 3,484 … 3,773