Should Encryption Be The Norm?

Encryption should be a matter of priority and used by default. That’s the message from the Internet Architecture Board (IAB), the worldwide body in charge of the internet’s technology infrastructure.

The IAB warned in a statement that “the capabilities and activities of attackers are greater and more pervasive than previously known”.

It goes on to say: “The IAB urges protocol designers to design for confidential operation by default. We strongly encourage developers to include encryption in their implementations, and to make them encrypted by default.

“We similarly encourage network and service operators to deploy encryption where it is not yet deployed, and we urge firewall policy administrators to permit encrypted traffic.”

The purpose, the IAB claims, is to instill public trust in the internet after the myriad high-profile cases in which computer traffic has been intercepted, ranging from bank details to email addresses and all points in between.

The news will be unwelcome to the security services, which have repeatedly objected to initiatives such as the default encryption in iOS8 and Android L, claiming that it is in the interest of the population to retain the right to intercept data for the prevention of terrorism.

However, leaked information, mostly from files appropriated by rogue NSA contractor Edward Snowden, suggests that the right of information interception is abused by security services including the UK’s GCHQ.

These allegations include the collection of irrelevant data, the investigation of cold cases not in the public interest, and the passing of pictures of nude ladies to colleagues.

Source

Amazon Intel Zeon Inside

Amazon has become the latest vendor to commission a customized Xeon chip from Intel to meet its exact compute requirements, in this case powering new high-performance C4 virtual machine instances on the AWS cloud computing platform.

Amazon announced at the firm’s AWS re:Invent conference in Las Vegas that the latest generation of compute-optimized Amazon Elastic Compute Cloud (EC2) virtual machine instances offer up to 36 virtual CPUs and 60GB of memory.

“These instances are designed to deliver the highest level of processor performance on EC2. If you’ve got the workload, we’ve got the instance,” said AWS chief evangelist Jeff Barr, detailing the new instances on the AWS blog.

The instances are powered by a custom version of Intel’s latest Xeon E5 v3 processor family, identified by Amazon as the Xeon E5-2666 v3. This runs at a base speed of 2.9GHz, and can achieve clock speeds as high as 3.5GHz with Turbo boost.

Amazon is not the first company to commission a customized processor from Intel. Earlier this year, Oracle unveiled new Sun Server X4-4 and Sun Server X4-8 systems with a custom Xeon E7 v2 processor.

The processor is capable of dynamically switching core count, clock frequency and power consumption without the need for a system level reboot, in order to deliver an elastic compute capability that adapts to the demands of the workload.

However, these are just the vendors that have gone public; Intel claims it is delivering over 35 customized versions of the Intel Xeon E5 v3 processor family to various customers.

This is an area the chipmaker seems to be keen on pursuing, especially with companies like cloud service providers that purchase a great many chips.

“We’re really excited to be working with Amazon. Amazon’s platform is the landing zone for a lot of new software development and it’s really exciting to partner with those guys on a SKU that really meets their needs,” said Dave Hill, ‎senior systems engineer in Intel’s Datacenter Group.

Also at AWS re:Invent, Amazon announced the Amazon EC2 Container Service, adding support for Docker on its cloud platform.

Currently available as a preview, the EC2 Container Service is designed to make it easy to run and manage distributed applications on AWS using containers.

Customers will be able to start, stop and manage thousands of containers in seconds, scaling from one container to hundreds of thousands across a managed cluster of Amazon EC2 instances, the firm said.

Source

Oracle And SAP Settle Piracy Dispute

Oracle has won a limited victory in its long-running lawsuit with rival SAP.

The action was taken in reference to events dating back to 2007, which saw employees of SAP’s TomorrowNow unit accused of illegally downloading Oracle software.

German company TomorrowNow was bought by SAP as a means to undercut Oracle’s internal tech support rates, with the ambition of getting customers to migrate to SAP solutions, reports Reuters.

In 2006, TomorrowNow started the process of undermining its parent’s position, offering cut-price support to users of the Siebel database and CRM.

Oracle was originally awarded $1.3bn back in 2010, but this was adjusted downwards on multiple appeals.

SAP acknowledged that its employees had been in the wrong, but disputed the damages awarded. SAP offered a $306m payment in 2012, but did so more in hope than expectation given its admissions.

Earlier in the year, a federal judge gave Oracle the option to settle for $356.7m or force a retrial, and the company has now decided on the former with a further $2.5m in interest.

“We are thrilled about this landmark recovery and extremely gratified that our efforts to protect innovation and our shareholders’ interests are duly rewarded,” said Oracle’s general counsel Dorian Daley.

“This sends a strong message to those who would prefer to cheat than compete fairly and legally.”

SAP agreed: “We are also pleased that, overall, the courts hearing this case ultimately accepted SAP’s arguments to limit Oracle’s excessive damages claims and that Oracle has finally chosen to end this matter.”

SAP announced a partnership with IBM last month to bring its HANA service to enterprise cloud users.

Source

New Malware Targeting Apple Devices

Palo Alto Networks Inc  has uncovered a new group of malware that can infect Apple Inc’s  desktop and mobile operating systems, underscoring the increasing sophistication of attacks on iPhones and Mac computers.

The “WireLurker” malware can install third-party applications on regular, non-jailbroken iOS devices and hop from infected Macs onto iPhones through USB connector-cables, said Ryan Olson, intelligence director for the company’s Unit 42 division.

Palo Alto Networks said on Wednesday it had seen indications that the attackers were Chinese. The malware originated from a Chinese third-party apps store and appeared to have mostly affected users within the country.

The malware spread through infected apps uploaded to the apps store, that were in turn downloaded onto Mac computers. According to the company, more than 400 such infected apps had been downloaded over 350,000 times so far.

It’s unclear what the objective of the attacks was. There is no evidence that the attackers had made off with anything more sensitive than messaging IDs and contacts from users’ address books, Olson added.

But “they could just as easily take your Apple ID or do something else that’s bad news,” he said in an interview.

Apple, which Olson said was notified a couple weeks ago, did not respond to requests for comment.

Once WireLurker gets on an iPhone, it can go on to infect existing apps on the device, somewhat akin to how a traditional virus infects computer software programs. Olson said it was the first time he had seen it in action. “It’s the first time we’ve seen anyone doing it in the wild,” he added.

Source

Dell Unveils 720TB Storage Server

Dell has unveiled the DCS XA90, an “ultra-dense” storage server capable of holding 720TB of data in a single 4U chassis.

Described by CEO Michael Dell on stage at the Dell World conference as “the power of a diesel truck in a Mini Cooper”, the DCS XA90 storage server means that a single Dell modular data centre of these units would hold 220PB of data, nearly a quarter of an exabyte.

“In a world where we could download our memories into those servers, we could house the experiences of about 90 people, an entire neighbourhood of digital lives,” said Dell.

He explained that the development of the DCS XA90 was driven by the demand for data storage that is “speeding us towards an exascale future”.

“That is what drove Dell to develop the DCS XA90 for our customers seeking extreme storage density and flexibility as they build out the cloud infrastructure of the future,” Dell added.

The DCS XA90 also packs two independent server nodes featuring Intel Xeon E5-2600v3 processors into each chassis, which Dell said makes it better for data-intensive analytics as well as archival storage.

As part of the announcement, Dell also revealed its PowerEdge FX architecture, a 2U enclosure with six PowerEdge server, storage and network IOA sleds built specifically to fit into the FX2 chassis and support varying workloads.

Due to ship in December, the PowerEdge FX architecture is described as “next-generation convergence” and a game changer in the IT industry, offering the flexibility to build configurations to meet requirements while simplifying management.

“There are other vendors who talk about convergence purely by doing an architecture rack,” said Dell’s server marketing vice president Ravi Pendekanti .

For example, HP’s Moonshot platform “just puts a bunch of blades together”, while Oracle’s Exadata platform “does one thing, and one thing really well, which is run Oracle’s enterprise applications”, he said.

The PowerEdge FX, which stands for ‘flexible infrastructure’, comprises a specially designed 2U rack-mount FX2 enclosure that can be filled with a choice of sled modules offering differing capabilities, enabling customers to adopt a building block approach to their infrastructure.

At launch, the sleds comprise a handful of full-width, half-width and quarter-width compute modules that allow customers to pick the performance and density required for applications such as web hosting, virtualisation or running databases, plus a half-width storage sled that can provide direct attached storage for the compute nodes.

Source

Adobe Eases Privacy Concerns

Tests on the latest version of Adobe System’s e-reader software reveals the company is now collecting less data following a privacy-related row last month, according to the Electronic Frontier Foundation.

Digital Editions version 4.0.1 appears to only collect data on e-books that have DRM (Digital Rights Management), wrote Cooper Quintin, a staff technologist with the EFF. DRM places restrictions on how content can be used with the intent of thwarting piracy.

Adobe was criticized in early October after it was discovered Digital Editions collected metadata about e-books on a device, even if the e-books did not have DRM. Those logs were also sent to Adobe in plain text.

Since that data was not encrypted, critics including the EFF contended it posed major privacy risks for users. For example, plain text content could be intercepted by an interloper from a user who is on the same public Wi-Fi network.

Adobe said on Oct. 23 it fixed the issues in 4.0.1, saying it would not collect data on e-books without DRM and encrypt data that is transmitted back to the company.

Quintin wrote the EFF’s latest test showed the “only time we saw data going back to an Adobe server was when an e-book with DRM was opened for the first time. This data is most likely being sent back for DRM verification purposes, and it is being sent over HTTPS.”

If an e-book has DRM, Adobe may record how long a person reads it or the percentage of the content that is read, which is used for “metered” pricing models.

Other technical metrics are also collected, such as the IP address of the device downloading a book, a unique ID assigned to the specific applications being used at the time and a unique ID for the device, according to Adobe.

Source

Amazon Tops Apple

A mere five months after Apple snatched J.D. Power’s tablet satisfaction award away from Samsung, it has lost it to up-and-coming Amazon.

Apple’s iPad finished in second place in the latest satisfaction survey conducted by J.D. Power and Associates, with a score of 824 out of a possible 1,000. For the first time, Amazon took first place, scoring 827.

Samsung came in at 821 for third, while Asus and Acer filled out the first five, but those stragglers’ scores were under the category average.

J.D. Power’s satisfaction score included five separate measurements for performance, ease of operation, features, styling and design, and cost, with each accounting for different percentages of the final number. Performance, for example, counted as 28% of the total; cost for 11%.

Apple received high scores in performance and styling and design, while Amazon performed best in ease of operation and cost, said Kirk Parsons, senior director of telecommunications services at J.D. Power.

“Within the tablet segment, there’s a balance of cost and value, and for this period, Amazon was at the equilibrium,” said Parsons. “For the money, [Amazon tablets] do what buyers need them to do. And the Mayday feature really helped them in ease of operation.”

Mayday is a feature on Amazon’s higher-end tablets that lets customers video chat with support representatives using the device.

Parsons called out Amazon’s Fire HDX, which launched in October 2013 in a 7-in. size and a month later in an 8.9-in. format, for driving the brand’s scores. Amazon now sells the 7-in. Fire HDX for $179; the 8.9-in. model starts at $379. “The new Fire HDX did really, really well” in the survey, Parsons noted.

J.D. Power polled nearly 2,700 U.S. tablet owners who had had their current devices for less than a year. The survey period ran from March to August.

The last time J.D. Power published tablet customer satisfaction scores, Amazon placed fourth. Its jump to first was a small surprise, said Parsons. “I figured [Amazon’s] scores would improve, but I didn’t think they’d take the top spot,” he admitted.

Price is increasingly important to satisfaction, said Parson, as costs fall and capabilities climb across the board, making it more difficult for premium-priced tablets like Apple’s iPad, to retain their polled positions. On average, tablet customers now spend $345 on their tablets, $48 less than in April 2013, a decline of 12%.

Source

Will The Drupal Flaw Be Catastrophic?

The Drupal web content management system has been exposed as having backdoor access that could deliver your site to hackers.

The problem is not particularly new. Drupal warned about it earlier this month, but it still needs tackling as millions of websites may be at risk.

Drupal said that sites running version 7 really ought to have upgraded to 7.32 by now, because not doing so leaves them as open as a torn tea bag.

Initially the alert was about the threat, but the firm has updated its earlier advice and is now warning of in-the-wild attacks.

That earlier advice was about a problem in a database API. “A vulnerability in this API allows an attacker to send specially crafted requests resulting in arbitrary SQL execution,” warned Drupal in a security alert.

“Depending on the content of the requests this can lead to privilege escalation, arbitrary PHP execution, or other attacks. This vulnerability can be exploited by anonymous users.”

More recent information from the firm points users toward the released upgrade, and informs them that attacks started not long after the initial announcement.

“You should proceed under the assumption that every Drupal 7 website was compromised unless updated or patched before Oct 15th, 11pm UTC, that is seven hours after the announcement,” it said, adding that, even when updated, sites will have some cleaning up to do.

“If you have not updated or applied this patch, do so immediately, then continue reading this announcement; updating to version 7.32 or applying the patch fixes the vulnerability but does not fix an already compromised website,” it explains.

“If you find that your site is already patched but you didn’t do it, that can be a symptom that the site was compromised – some attacks have applied the patch as a way to guarantee they are the only attacker in control of the site.”

Gavin Millard, EMEA technical director at Tenable Network Security, advised people to follow Drupal’s advice.

“The so-called ‘Drupageddon’ vulnerability could have easily led to exploitation of any systems running the vulnerable code. With such an easy to exploit flaw, the chance of exfiltration of data or further exploitation are high,” he said.

“For those who have good security controls, reviewing of logs and traffic directed at the sites following the vulnerability being announced and the patch applied is common sense and highly advisable, with appropriate action taken if indicators of compromise are found.

“For those who don’t have such a good level of security or visibility into the logs, the advice from the Drupal team should be heeded. If you don’t know if you were exploited you should assume that you have been.”

Source

Will Google’s Algorithm Stop Piracy?

Nosey Google has updated its search engine algorithms in an attempt to restrict piracy web sites appearing high in its search rankings.

The update will mean piracy sites are less likely to appear when people search for music, films and other copyrighted content.

The decision to roll out the search changes was announced in a refreshed version of a How Google Fights Piracy report, which was originally published in September 2013.

However, this year’s updated report features a couple of developments, including changes to ad formats and an improved DMCA demotion search signal.

The move is likely to be a result of criticism received from the entertainment industry, which has argued that illegal sites should be “demoted” in search results because they enable people to find sites to download media illegally.

The biggest change in the Google search update will be new ad formats in search results on queries related to music and movies that help people find legitimate sources of media.

For example, for the relatively small number of queries for movies that include terms like ‘download’, ‘free’, or ‘watch’, Google has instead begun listing legal services such as Spotify and Netflix in a box at the top of the search results.

“We’re also testing other ways of pointing people to legitimate sources of music and movies, including in the right-hand panel on the results page,” Google added.

“These results show in the US only, but we plan to continue investing in this area and to expand it internationally.”

An improved DMCA demotion signal in Google search is also being rolled out as part of the refresh, which down-ranks sites for which Google has received a large number of valid DMCA notices.

“We’ve now refined the signal in ways we expect to visibly affect the rankings of some of the most notorious sites. This update will roll out globally starting next week,” Google said, adding that it will also be removing more terms from autocomplete, based on DMCA removal notices.

The new measures might be welcomed by the entertainment industry, but are likely to encourage more people to use legal alternatives such as Spotify and Netflix, rather than buying more physical media.

Source

MasterCard Testing New Fingerprint Reader

MasterCard is trying out a contactless payment card with a built-in fingerprint reader that can authorize high-value payments without requiring the user to enter a PIN.

The credit-card company showed a prototype of the card in London on Friday along with Zwipe, the Norwegian company that developed the fingerprint recognition technology.

The contactless payment card has an integrated fingerprint sensor and a secure data store for the cardholder’s biometric data, which is held only on the card and not in an external database, the companies said.

The card also has an EMV chip, used in European payment cards instead of a magnetic stripe to increase payment security, and a MasterCard application to allow contactless payments.

The prototype shown Friday is thicker than regular payment cards to accommodate a battery. Zwipe said it plans to eliminate the battery by harvesting energy from contactless payment terminals and is working on a new model for release in 2015 that will be as thin as standard cards.

Thanks to its fingerprint authentication, the Zwipe card has no limit on contactless payments, said a company spokesman. Other contactless cards can only be used for payments of around €20 or €25, and some must be placed in a reader and a PIN entered once the transaction reaches a certain threshold.

Norwegian bank Sparebanken DIN has already tested the Zwipe card, and plans to offer biometric authentication and contactless communication for all its cards, the bank has said.

MasterCard wants cardholders to be able to identify themselves without having to use passwords or PINs. Biometric authentication can help with that, but achieving simplicity of use in a secure way is a challenge, it said.

Source

« Previous Page — Next Page »