NSA Spies With Tracking Cookies

The browser cookies that online businesses use to track Internet customers for targeted advertising are also used by the National Security Agency to track surveillance targets and break into their systems.

The agency’s use of browser cookies is restricted to tracking specific suspects rather than sifting through vast amounts of user data, theWashington Post reported Tuesday, citing internal documents obtained from former NSA contractor Edward Snowden.

Google’s PREF (for preference) cookies, which the company uses to personalize webpages for Internet users based on their previous browsing habits and preferences, appears to be a particular favorite of the NSA, the Post noted.

PREF cookies don’t store any user identifying information such as user name or email address. But they contain information on a user’s general location, language preference, search engine settings, number of search results to display per page and other data that lets advertisers uniquely identify an individual’s browser.

The Google cookie, and those used by other online companies, can be used by the NSA to track a target user’s browsing habits and to enable remote exploitation of their computers, the Post said.

Documents made available by Snowden do not describe the specific exploits used by the NSA to break into a surveillance target’s computers. Neither do they say how the NSA gains access to the tracking cookies, the Post reported.

It is theorized that one way the NSA could get access to the tracking cookies is to simply ask the companies for them under the authority granted to the agency by the Foreign Intelligence Surveillance Act (FISA).

Separately, the documents leaked by Snowden show that the NSA is also tapping into cell-phone location data gathered and transmitted by makers of mobile applications and operating systems. Google and other Internet companies use the geo-location data transmitted by mobile apps and operating systems to deliver location-aware advertisements and services to mobile users.

However, the NSA is using the same data to track surveillance targets with more precision than was possible with data gathered directly from wireless carriers, the Post noted. The mobile app data, gathered by the NSA under a program codenamed “Happyfoot,” allows the agency to tie Internet addresses to physical locations more precisely than was possible with cell-phone location data.

An NSA division called Tailored Access Operations uses the data gathered from tracking cookies and mobile applications to launch offensive hacking operations against specific target computers, the Post said.

An NSA spokeswoman Wednesday did not comment on the specific details in the Post story but reiterated the agency’s commitment to fulfill its mission of protecting the country against those seeking to do it harm.

“As we’ve said before, NSA, within its lawful mission to collect foreign intelligence to protect the United States, uses intelligence tools to understand the intent of foreign adversaries and prevent them from bringing harm to innocent Americans and allies,” the spokeswoman said.

The Post’s latest revelations are likely to shine a much-needed spotlight on the extensive tracking and monitoring activities carried out by major Internet companies in order to deliver targeted advertisements to users.

Privacy rights groups have protested such tracking for several years and have sought legislation that would give users more visibility and control over the data that is collected on them by online companies.

Source

IBM To Become Cloud Broker

IBM is in the throes of developing software that will allow organizations to use multiple cloud storage services interchangeably, reducing dependence on any single cloud vendor and ensuring that data remains available even during service outages.

Although the software, called InterCloud Storage (ICStore), is still in development, IBM is inviting its customers to test it. Over time, the company will fold the software into its enterprise storage portfolio, where it can back up data to the cloud. The current test iteration requires an IBM Storewize storage system to operate.

ICStore was developed in response to customer inquiries, said Thomas Weigold, who leads the IBM storage systems research team in IBM’s Zurich, Switzerland, research facility, where the software was created. Customers are interested in cloud storage services but are worried about trusting data with third party providers, both in terms of security and the reliability of the service, he said.

The software provides a single interface that administrators can use to spread data across multiple cloud vendors. Administrators can specify which cloud providers to use through a point-and-click interface. Both file and block storage is supported, though not object storage. The software contains mechanisms for encrypting data so that it remains secure as it crosses the network and resides on the external storage services.

A number of software vendors offer similar cloud storage broker capabilities, all in various stages of completion, notably Red Hat’s DeltaCloud and Hewlett Packard’s Public Cloud.

ICStore is more “flexible,” than other approaches, said Alessandro Sorniotti, an IBM security and cloud system researcher who also worked on the project. “We give customers the ability to select what goes where, depending on the sensitivity and relevance of data,” he said. Customers can store one copy of their data on one provider and a backup copy on another provider.

ICStore supports a number of cloud storage providers, including IBM’s SoftLayer, Amazon S3 (Simple Storage Service), Rackspace, Microsoft Windows Azure and private instances of the OpenStack Swift storage service. More storage providers will be added as the software goes into production mode.

“Say, you are using SoftLayer and Amazon, and if Amazon suffers an outage, then the backup cloud provider kicks in and allows you to retrieve data,” from SoftLayer, Sorniotti said.

ICStore will also allow multiple copies of the software to work together within an enterprise, using a set of IBM patent-pending algorithms developed for data sharing. This ensures that the organization will not run into any upper limits on how much data can be stored.

IBM has about 1,400 patents that relate to cloud computing, according to the company.

Source

HP Retakes Server Lead

Hewlett-Packard reclaimed its server crown from IBM last quarter as the overall market contracted and Taiwanese vendors made big gains selling directly to Internet giants like Google and Facebook, according to an IDC report.

HP expanded its share of the market only modestly from a year earlier but IBM’s portion declined 4.5 points despite solid mainframe sales, to leave HP in the top spot. HP finished the third quarter with 28.1% of worldwide server revenue to IBM’s 23.4%, IDC said.

But the strongest growth was for the “ODM direct” segment which IDC broke out for the first time this quarter. It stands for original design manufacturers, which are Taiwanese firms like Quanta Computer, Wistron Group, Inventec and Compal, which sell partial and fully-built servers to the big cloud providers.

It’s a growing segment and one that threatens the incumbents. ODM’s accounted for 6.5% of server revenue last quarter, up 45.2% from a year earlier, IDC said. If the ODM category were a single vendor, it would be the third largest ahead of Dell.

Almost 80% of the ODM’s server revenue came from the U.S., primarily from sales to Google, Amazon, Facebook and Rackspace.

Overall, the server market declined 3.7% from a year earlier to $12.1 billion. It was the third consecutive quarter of declining revenue but IDC predicts improvement with a refresh cycle early next year. In terms of units shipped, volumes were about flat year over year, meaning average selling prices dropped.

Volume systems — mostly x86 servers — picked up slightly from last year, with 3.5% revenue growth. But sales of midrange and high-end systems dropped 17.8% and 22.5%, respectively, IDC said.

IBM fared worst of the top 5 vendors, with revenue down 19.4% due to “soft demand for System x and Power Systems,” IDC said. Dell retained third place with 16.2% of revenue, about flat from last year, while Cisco Systems and Oracle tied for fourth.

Cisco saw the most growth of the top vendors, with a nearly 43% revenue jump, IDC said.

Source

App Stores For Supercomputers Enroute

A major problem facing supercomputing is that the firms that could benefit most from the technology, aren’t using it. It is a dilemma.

Supercomputer-based visualization and simulation tools could allow a company to create, test and prototype products in virtual environments. Couple this virtualization capability with a 3-D printer, and a company would revolutionize its manufacturing.

But licensing fees for the software needed to simulate wind tunnels, ovens, welds and other processes are expensive, and the tools require large multicore systems and skilled engineers to use them.

One possible solution: taking an HPC process and converting it into an app.

This is how it might work: A manufacturer designing a part to reduce drag on an 18-wheel truck could upload a CAD file, plug in some parameters, hit start and let it use 128 cores of the Ohio Supercomputer Center’s (OSC) 8,500 core system. The cost would likely be anywhere from $200 to $500 for a 6,000 CPU hour run, or about 48 hours, to simulate the process and package the results up in a report.

Testing that 18-wheeler in a physical wind tunnel could cost as much $100,000.

Alan Chalker, the director of the OSC’s AweSim program, uses that example to explain what his organization is trying to do. The new group has some $6.5 million from government and private groups, including consumer products giant Procter & Gamble, to find ways to bring HPC to manufacturers via an app store.

The app store is slated to open at the end of the first quarter of next year, with one app and several tools that have been ported for the Web. The plan is to eventually spin-off AweSim into a private firm, and populate the app store with thousands of apps.

Tom Lange, director of modeling and simulation in P&G’s corporate R&D group, said he hopes that AweSim’s tools will be used for the company’s supply chain.

The software industry model is based on selling licenses, which for an HPC application can cost $50,000 a year, said Lange. That price is well out of the reach of small manufacturers interested in fixing just one problem. “What they really want is an app,” he said.

Lange said P&G has worked with supply chain partners on HPC issues, but it can be difficult because of the complexities of the relationship.

“The small supplier doesn’t want to be beholden to P&G,” said Lange. “They have an independent business and they want to be independent and they should be.”

That’s one of the reasons he likes AweSim.

AweSim will use some open source HPC tools in its apps, and are also working on agreements with major HPC software vendors to make parts of their tools available through an app.

Chalker said software vendors are interested in working with AweSim because it’s a way to get to a market that’s inaccessible today. The vendors could get some licensing fees for an app and a potential customer for larger, more expensive apps in the future.

AweSim is an outgrowth of the Blue Collar Computing initiative that started at OSC in the mid-2000s with goals similar to AweSim’s. But that program required that users purchase a lot of costly consulting work. The app store’s approach is to minimize cost, and the need for consulting help, as much as possible.

Chalker has a half dozen apps already built, including one used in the truck example. The OSC is building a software development kit to make it possible for others to build them as well. One goal is to eventually enable other supercomputing centers to provide compute capacity for the apps.

AweSim will charge users a fixed rate for CPUs, covering just the costs, and will provide consulting expertise where it is needed. Consulting fees may raise the bill for users, but Chalker said it usually wouldn’t be more than a few thousand dollars, a lot less than hiring a full-time computer scientist.

The AweSim team expects that many app users, a mechanical engineer for instance, will know enough to work with an app without the help of a computational fluid dynamics expert.

Lange says that manufacturers understand that producing domestically rather than overseas requires making products better, being innovative and not wasting resources. “You have to be committed to innovate what you make, and you have to commit to innovating how you make it,” said Lange, who sees HPC as a path to get there.

Source

Is The US & UK Lacking In Broadband?

The US and UK are stragglers when it comes to consumer broadband download speeds and appear far down in table rankings.

This puts the countries, swaggering authoritarian surveillance monsters that they are, rather low down on the satisfaction scale.

The ranking produced by Ookla is based on results from Speedtest servers, and is called the Net Index.

“Based on millions of recent test results from Speedtest.net, this index compares and ranks consumer download speeds around the globe,” is the explanation.

“The value is the rolling mean throughput in Mbps over the past 30 days where the mean distance between the client and the server is less than 300 miles.”

Hong Kong takes pole position and it is credited as having download speeds in the area of 71.03 Mbps. There is a big drop of around 20 Mbps down to Singapore in second place with 52.85 Mbps and third is Romania, where speeds are 50.82 Mbps.

You have to look a long way down the list before arriving at the UK, which is in 25th place. Here, or there depending on where you live, consumers get a rather meagre sounding 23.55 Mbps.

The United States weighs in at 31st place and has download speeds of 20.77 Mbps. This puts it below the UK, Germany, Estonia, Hungary, Greece and 25 others.

Closer to home the European Commission has published its report on Broadband Coverage in Europe (2012) and reveals progress on broadband coverage targets. It found that while broadband has improved, it could be faster.

Source

Will Computer Obtain Common Sense?

Even though it may appear PCs are getting dumbed down as we see constant images of cats playing the piano or dogs playing in the snow, one computer is doing the same and getting smarter and smarter.

A computer cluster running the so-called the Never Ending Image Learner at Carnegie Mellon University runs 24 hours a day, 7 days a week searching the Internet for images, studying them on its own and building a visual database. The process, scientists say, is giving the computer an increasing amount of common sense.

“Images are the best way to learn visual properties,” said Abhinav Gupta, assistant research professor in Carnegie Mellon’s Robotics Institute. “Images also include a lot of common sense information about the world. People learn this by themselves and, with [this program], we hope that computers will do so as well.”

The computers have been running the program since late July, analyzing some three million images. The system has identified 1,500 types of objects in half a million images and 1,200 types of scenes in hundreds of thousands of images, according to the university.

The program has connected the dots to learn 2,500 associations from thousands of instances.

Thanks to advances in computer vision that enable software to identify and label objects found in images and recognize colors, materials and positioning, the Carnegie Mellon cluster is better understanding the visual world with each image it analyzes.

The program also is set up to enable a computer to make common sense associations, like buildings are vertical instead of lying on their sides, people eat food, and cars are found on roads. All the things that people take for granted, the computers now are learning without being told.

“People don’t always know how or what to teach computers,” said Abhinav Shrivastava, a robotics Ph.D. student at CMU and a lead researcher on the program. “But humans are good at telling computers when they are wrong.”

He noted, for instance, that a human might need to tell the computer that pink isn’t just the name of a singer but also is the name of a color.

While previous computer scientists have tried to “teach” computers about different real-world associations, compiling structured data for them, the job has always been far too vast to tackle successfully. CMU noted that Facebook alone has more than 200 billion images.

The only way for computers to scan enough images to understand the visual world is to let them do it on their own.

“What we have learned in the last five to 10 years of computer vision research is that the more data you have, the better computer vision becomes,” Gupta said.

CMU’s computer learning program is supported by Google and the Office of Naval Research.

Source

Researchers Build Flying Robot

Researchers say they have assembled a flying robot. It’s not designed to fly like a bird or an insect, but was built to simulate the movements of a swimming jellyfish.

Scientists at New York University say they built the small, flying vehicle to move like the boneless, pulsating, water-dwelling jellyfish.

Leif Ristroph, a post-doctoral student at NYU and a lead researcher on the project, explained that previous flying robots were based on the flight of birds or insects, such as flies.

Last spring, for example, Harvard University researchers announced that they had built an insect-like robot that flies by flapping its wings. The flying robot is so small it has about 1/30th the weight of a U.S. penny.

Before the Harvard work was announced, researchers at the University of Sheffield and the University of Sussex in England worked together to study thebrains of honey bees in an attempt to build an autonomous flying robot.

By creating models of the systems in a bee’s brain that control vision and sense of smell, scientists hope to build a robot that would be able to sense and act as autonomously as a bee.

The problem with those designs, though, is that the flapping wing of a fly is inherently unstable, Ristroph noted.

“To stay in flight and to maneuver, a fly must constantly monitor its environment to sense every gust of wind or approaching predator, adjusting its flying motion to respond within fractions of a second,” Ristroph said. “To recreate that sort of complex control in a mechanical device — and to squeeze it into a small robotic frame — is extremely difficult.”

To get beyond those challenges, Ristroph built a prototype robot that is 8 centimeters wide and weighs two grams. The robot flies by flapping four wings arranged like petals on a flower that pulsate up and down, resembling the flying motion of a moth.

The machine, according to NYU, can hover and fly in a particular direction.

There is more work still to be done. Ristroph reported that his prototype doesn’t have a battery but is attached to an external power source. It also can’t steer, either autonomously or via remote control.

Source

3D Printer Goes Retail

MakerBot, a 3D printer maker which opened two new retail stores last week, is among the companies trying to bring the cutting-edge digital manufacturing technology to Main Street consumers, but skeptics say the debut may be premature.

MakerBot, a unit of Stratasys Ltd, opened retail stores this week in Boston and in Greenwich, Connecticut, both of which are twice the size of MakerBot’s first store, 1,500 square feet in downtown Manhattan.

The company offers designs for more than 100,000 items through its “Thingiverse” online user community. The products range from knick-knacks like zombie sculptures to jewelry, sink drains and even medical devices. They are printed using its line of corn-based plastic fibers in more than a dozen colors.

“For most people 3D printing is futuristic science fiction. We’re here to make it real,” said CEO Bre Pettis, who cut the ribbon at the store on Boston’s fashionable Newbury Street using scissors made on one of MakerBot’s Replicator printers which start at $2,199.

Pettis, who has purchased splashy magazine ads to promote 3D printers as holiday gifts, believes there could soon be a 3D printer on every block in America.

Yet some technology experts say 3D printers may not be ready for prime time because they are still much less user friendly than most modern consumer electronics.

“There is so much hype,” said Pete Basiliere, an analyst at technology research firm Gartner. “People are getting a little bit misled as to how easy it is,” he said.

Some investors also are skeptical of 3D printing’s readiness for the market. Short-seller Citron this week published an article questioning the earnings of Germany’s voxeljet AG’s, and shares in the sector fell, including those of MakerBot parent Stratasys and rivals 3D Systems Corp and ExOne Co.

Source

Twitter Tightens Security

Twitter Inc said it has put in place a security technology that makes it harder to spy on its users and called on other Internet firms to do the same, as Web providers look to thwart spying by government intelligence agencies.

The online messaging service, which began scrambling communications in 2011 using traditional HTTPS encryption, said on Friday it has added an advanced layer of protection for HTTPS known as “forward secrecy.”

“A year and a half ago, Twitter was first served completely over HTTPS,” the company said in a blog posting. “Since then, it has become clearer and clearer how important that step was to protecting our users’ privacy.”

Twitter’s move is the latest response from U.S. Internet firms following disclosures by former spy agency contractor Edward Snowden about widespread, classified U.S. government surveillance programs.

Facebook Inc, Google Inc, Microsoft Corp and Yahoo Inc have publicly complained that the government does not let them disclose data collection efforts. Some have adopted new privacy technologies to better secure user data.

Forward secrecy prevents attackers from exploiting one potential weakness in HTTPS, which is that large quantities of data can be unscrambled if spies are able to steal a single private “key” that is then used to encrypt all the data, said Dan Kaminsky, a well-known Internet security expert.

The more advanced technique repeatedly creates individual keys as new communications sessions are opened, making it impossible to use a master key to decrypt them, Kaminsky said.

“It is a good thing to do,” he said. “I’m glad this is the direction the industry is taking.”

Source

Adobe Data Found Online

A computer security firm has discovered data it says belongs to some 152 million Adobe Systems Inc user accounts, suggesting that a breach reported a month ago is much larger than Adobe has so far disclosed and is one of the largest on record.

LastPass, a password security firm, said that it has found email addresses, encrypted passwords and password hints stored in clear text from Adobe user accounts on an underground website frequented by cyber criminals.

Adobe said last week that attackers had stolen data on more than 38 million customer accounts, on top of the theft of information on nearly 3 million accounts that it disclosed nearly a month earlier.

The maker of Photoshop and Acrobat software confirmed that LastPass had found records stolen from its data center, but downplayed the significance of the security firm’s findings.

While the new findings from LastPass indicate that the Adobe breach is far bigger than previously known, company spokeswoman Heather Edell said it was not accurate to say 152 million customer accounts had been compromised because the database attacked was a backup system about to be decommissioned.

She said the records include some 25 million records containing invalid email addresses, 18 million with invalid passwords. She added that “a large percentage” of the accounts were fictitious, having been set up for one-time use so that their creators could get free software or other perks.

She also said that the company is continuing to work with law enforcement and outside investigators to determine the cost and scope of the breach, which resulted in the theft of customer data as well as source code to several software titles.

The company has notified some 38 million active Adobe ID users and is now contacting holders of inactive accounts, she said.

Paul Stephens, director of policy and advocacy for the non-profit Privacy Rights Clearinghouse, said information in an inactive database is often useful to criminals.

He said they might use it to engage in “phishing” scams or attempt to figure out passwords using the hints provided for some of the accounts in the database. In some cases, people whose data was exposed might not be aware of it because they have not accessed the out-of-date accounts, he said.

“Potentially it’s the website you’ve forgotten about that poses the greater risk,” he said. “What if somebody set up an account with Adobe ten years ago and forgot about it and they use the same password there that they use on other sites?”

Source

« Previous Page — Next Page »