Posts


May. 28, 2018

Oracle Plans to Drop Java Serialization Support, the Source of Most Security Bugs

Oracle Plans to Drop Java Serialization Support, the Source of Most Security Bugs

Oracle plans to drop support for data serialization/deserialization from the main body of the Java language, according to Mark Reinhold, chief architect of the Java platform group at Oracle. Serialization is the process of taking a data object and converting it into a stream of bytes (binary format), so it can be transported across a network or saved inside a database, only to be deserialized later and used in its original form. Serializing and deserializing data is not a problem by itself, or when the source of the data is known to be safe.

May. 28, 2018

China is exporting facial recognition software to Africa

China is exporting facial recognition software to Africa

For all the promise it holds for the future, artificial intelligence is still guilty of historic bias. Voice recognition software struggles with English accents that are not American or British and facial recognition can be guilty of racial profiling. As this technology increasingly outpaces human discourse on race, China seems to be getting ahead on recognizing a diverse range of faces across the wider world, despite its own struggles with racial insensitivity.

May. 28, 2018

Epyc fail? We can defeat AMD’s virtual machine encryption, say boffins

Epyc fail? We can defeat AMD’s virtual machine encryption, say boffins

German researchers reckon they have devised a method to thwart the security mechanisms AMD’s Epyc server chips use to automatically encrypt virtual machines in memory. So much so, they said they can exfiltrate plaintext data from an encrypted guest via a hijacked hypervisor and simple HTTP requests to a web server running in a second guest on the same machine. AMD’s data-center processors, as well as its Ryzen Pro line, support what’s called Secure Encrypted Virtualization.

May. 28, 2018

Freezing Your Credit Will Be Free Later This Year

Freezing Your Credit Will Be Free Later This Year

Soon you won’t have to pay to freeze your credit. As part of a new bank deregulation bill passed by Congress on Tuesday, the new law will make it so consumers can both place and remove credit freezes at no cost, a process that currently costs between $2 and $10, depending on where you live, and needs to be done at all three credit bureaus in order to be effective, Lifehacker reports. Interest in credit freezing rose last year when the Equifax hack exposed the personal information of about 148 million Americans.

May. 28, 2018

The Pentagon Has a Big Plan to Solve Identity Verification in Two Years

The Pentagon Has a Big Plan to Solve Identity Verification in Two Years

The Defense Department is funding a project that officials say could revolutionize the way companies, federal agencies and the military itself verify that people are who they say they are and it could be available in most commercial smartphones within two years. The technology, which will be embedded in smartphones’ hardware, will analyze a variety of identifiers that are unique to an individual, such as the hand pressure and wrist tension when the person holds a smartphone and the person’s peculiar gait while walking, said Steve Wallace, technical director at the Defense Information Systems Agency. Organizations that use the tool can combine those identifiers to give the phone holder a “risk score,” Wallace said.

May. 28, 2018

A floating Pacific island is in the works with its own government, cryptocurrency and 300 houses

A floating Pacific island is in the works with its own government, cryptocurrency and 300 houses

The Floating Island Project plans to create off-shore housing that uses its own currency and operates outside of government regulations. The project is a pilot program in partnership with the government of French Polynesia. A long-term vision for the project is hundreds of new countries floating on the ocean.

The Floating Island Project plans to create off-shore housing that uses its own currency and operates outside of government regulations. The project is a pilot program in partnership with the government of French Polynesia. The project is funded through philanthropic donations via the Seasteading Institute and Blue Frontiers, which sells tokens of the cryptocurrency Varyon.

May. 28, 2018

Stablecoins: Brilliant idea or ticking time bomb?

Stablecoins: Brilliant idea or ticking time bomb?

If you have been in crypto for more than two minutes, you know one simple fact: Coin prices are really volatile. And that volatility isn’t just tough on investors. It’s also tough on those who provide services to crypto startups in exchange for tokens — and for the crypto startups themselves, who are having to run a business with an ever-changing budget.

Given the growth of the crypto sector in the past year, significantly increased interest by institutional investors and the high volatility of many assets, the concept of stablecoins has seen quite a bit of interest. As the name implies, stablecoins are crypto-assets that seek to hold a consistent value vis-a-vis another currency. There is a lot of great material out there on the topic.

May. 28, 2018

Bitcoin backlash as ‘miners’ stress power grids in Central Washington

Bitcoin backlash as ‘miners’ stress power grids in Central Washington

Public hearings for rural electric utilities are rarely sellout events. But the crowd that showed up in Wenatchee two weeks ago for a hearing about Bitcoin mining in Chelan County was so large that utility staff had to open a second room with a video feed for the overflow. As a result, an area famous for apples, wheat and conservative politics has been transformed into a kind of cyber-boomtown, with Bitcoin mining operations that range from large-scale, state-of-the-art warehouses to repurposed cargo containers to backyard sheds.

May. 28, 2018

ZeppelinOS, a platform for smart contract applications in Ethereum

ZeppelinOS, a platform for smart contract applications in Ethereum

Today we’re excited to announce the first mainnet release of ZeppelinOS, a platform for developing, managing, and operating smart contract applications in Ethereum. You can start using it right now at zeppelinos.org. Until now, it was difficult and costly to fix problems in smart contracts.

Hundreds of millions of dollars were put at risk because of easy-to-fix vulnerabilities, but fixing them was too costly or even impossible. With ZeppelinOS, that will no longer be a problem. Developers can now build smart contracts that can be easily upgraded over time.

May. 26, 2018

GDPR Version of USA Today Is 500KB Instead of 5.2MB

GDPR Version of USA Today Is 500KB Instead of 5.2MB

“Because of #GDPR, USA Today decided to run a separate version of their website for EU users, which has all the tracking scripts and ads removed. The site seemed very fast, so I did a performance audit. How fast the internet could be without all the junk! ?

5.2MB → 500KB”

Source: twitter.com

May. 26, 2018

Doctor slammed by med board for selling $5 homeopathic sound waves for Ebola

Doctor slammed by med board for selling $5 homeopathic sound waves for Ebola

The California medical board is threatening to revoke the license of Dr. William Edwin Gray III for selling homeopathic sound files over the Internet that he claims—without evidence or reason—can cure a variety of ailments, including life-threatening infections such as Ebola, SARS, swine flu, malaria, typhoid, and cholera. That leaves Gray’s fate entirely in the hands of the board, which will make a decision in coming weeks, according to the Times. Gray seemed unbothered by the prospect of losing his medical license.

May. 26, 2018

The FBI wants you to reboot your router NOW to help destroy a botnet

The FBI wants you to reboot your router NOW to help destroy a botnet

In a public service announcement published Friday and noted by Ars Technica, and a new addition to aUS Department of Justice press release, the FBI explains that it’s hoping that your actions will help the US government destroy a botnet before a Russian hacking group, Sofacy, can harden the malware’s defenses. How would pressing a button on your router help, though? According to the FBI, rebooting your router will destroy the part of the malware that can do nasty things like spy on your activities, while leaving the install package intact.

May. 25, 2018

Detecting Lies through Mouse Movements

Detecting Lies through Mouse Movements

The detection of faked identities is a major problem in security. Current memory-detection techniques cannot be used as they require prior knowledge of the respondent’s true identity. Here, we report a novel technique for detecting faked identities based on the use of unexpected questions that may be used to check the respondent identity without any prior autobiographical information.

While truth-tellers respond automatically to unexpected questions, liars have to “build” and verify their responses. This lack of automaticity is reflected in the mouse movements used to record the responses as well as in the number of errors. Responses to unexpected questions are compared to responses to expected and control questions (i.e., questions to which a liar also must respond truthfully).

May. 25, 2018

Blocking 500M Users Easier Than Complying with GDPR

Blocking 500M Users Easier Than Complying with GDPR

For some of America’s biggest newspapers and online services, it’s easier to block half a billion people from accessing your product than comply with Europe’s new General Data Protection Regulation. With about 500 million people living in the European Union, that’s a hard ban on one-and-a-half times the population of the U.S. A&E Television Networks has narrowed its EU blockade to limit the damage to its audience. Websites for its History and Lifetime channels greet the European visitors with a message that its ‘content is not available in your area,’ whereas the website for youth-focused Viceland remains accessible.

May. 25, 2018

BackSwap malware finds innovative ways to empty bank accounts

BackSwap malware finds innovative ways to empty bank accounts

To steal money from a victim’s account via the internet banking interface, typical banking malware will inject itself or its specialized banking module into the browser’s process address space. For many reasons, this is not an easy task – first of all, as mentioned before, the injection might be intercepted by a third-party security solution. The injected module also needs to match the bitness of the browser – a 32-bit module cannot be injected into a 64-bit browser process and vice versa.

May. 25, 2018

Z-Shave Attack Could Impact Over 100 Million IoT Devices

Z-Shave Attack Could Impact Over 100 Million IoT Devices

The Z-Wave wireless communications protocol used for some IoT/smart devices is vulnerable to a downgrade attack that can allow a malicious party to intercept and tamper with traffic between smart devices. The attack —codenamed Z-Shave— relies on tricking two smart devices that are pairing into thinking one of them does not support the newer S-Wave S2 security features, forcing both to use the older S0 security standard. An attacker that can trick a smart device into pairing with another device, a PC, or a smartphone app via the older S0 standard, can later decrypt all traffic exchanged between the two because the decryption key is widely known.

May. 25, 2018

Malware Found in the Firmware of 141 Low-Cost Android Devices

Malware Found in the Firmware of 141 Low-Cost Android Devices

News of this group first surfaced after a report in December 2016, when Russian antivirus vendor Dr.Web disclosed that a mysterious threat actor had found a way to penetrate the supply-chain of several mobile carriers, infecting phones with malware. At the time, experts said they found malware in the firmware of at least 26 low-cost Android smartphone and tablets models. Once ousted, Dr.Web hoped crooks would pack up and move on to another operation.

May. 25, 2018

The Ethereum-blockchain size has exceeded 1TB, and yes, it’s an issue

The Ethereum-blockchain size has exceeded 1TB, and yes, it’s an issue

This is not about archival nodes. This is about about staying in sync, after the fact. My Argument: Ethereum’s runaway data directory size is just the tip.

My Prediction: It will all work, until it doesn’t. My Suggestion: Transpose. My Argument: Ethereum’s runaway data directory size is just the tip.

My Prediction: It will all work, until it doesn’t. My Suggestion: Transpose. My Argument:

May. 24, 2018

Blockchain vs. Distributed Ledger Technologies Part 2: Governing Dynamics

Blockchain vs. Distributed Ledger Technologies Part 2: Governing Dynamics

It should be acknowledged that if database coordination and more efficient allocation of code is the desired functionality of a system, then blockchain may not necessarily be the solution for which an organization is looking. Distributed ledger technology (DLT) systems like IBM Fabric or R3 Corda are capable of similar functionalities as blockchain systems, but it should be taken into consideration that blockchains are a separate subset of distributed ledgers that have additional functionality beyond code coordination. Blockchains are capable of functions that distributed ledgers are not in terms of instantiation of digital value based on the composition of the system.

May. 24, 2018

The DoJ is reportedly probing the murky world of bitcoin trading

The DoJ is reportedly probing the murky world of bitcoin trading

Bitcoin and other cryptocurrencies have taken a wild ride over the past 18 months. Now, according to Bloomberg News, the US Department of Justice has opened a criminal investigation into whether price manipulations have contributed to the meteoric rises and crushing falls. The coins prosecutors are examining include bitcoin and ether, which have both bounced up and down over the past 18 months.