Independent – Page 149 – Computer Security Articles

Credit to Author: Gregg Keizer| Date: Tue, 19 Feb 2019 13:03:00 -0800

Microsoft has revised its schedule to dump support for an outdated cryptographic hash standard by postponing the deadline for Windows 7.

Microsoft, like other software vendors, digitally “signs” updates before they are distributed via the Internet. SHA-1 (Secure Hash Algorithm 1), which debuted in 1995, was declared insecure a decade later, but it was retained for backward-compatibility reasons, primarily for Windows 7. Microsoft wants to ditch SHA-1 and rely only on the more-secure SHA-2 (Secure Hash Algorithm 2).

Late last year, Microsoft said that it would update Windows 7 and Windows Server 2008 R2 SP1 (Service Pack 1) this month with support for SHA-2. Systems running those operating systems would not receive the usual monthly security updates after April’s collection, slated for release April 9, Microsoft promised at the time.

To read this article in full, please click here

ComputerWorld Independent

February 19, 2019 admin

Yabba dabba doo!

Credit to Author: Sharky| Date: Tue, 19 Feb 2019 03:00:00 -0800

Fish is being onboarded as a software engineer and has to download the code repository and start building it. But in checking the setup guide, he can’t find any instructions on what user credentials to use to log in. This seems like something he should be able to figure out, so he trolls through multiple document systems (internal websites, Google documents and wikis) until he finds an old document that says to use his username as both username and password for version control access. That’s easy enough — but it doesn’t work. Fish gets a message saying his account wasn’t found or the password didn’t match.

Time to submit a help desk ticket. And the explanation is simple. IT had neglected to run the script that created an account for fish in the version control system. Ten minutes after submitting the ticket, fish is in at last.

To read this article in full, please click here

Independent Krebs

February 18, 2019 admin

A Deep Dive on the Recent Widespread DNS Hijacking Attacks

Credit to Author: BrianKrebs| Date: Mon, 18 Feb 2019 13:51:01 +0000

The U.S. government — along with a number of leading security companies — recently warned about a series of highly complex and widespread attacks that allowed suspected Iranian hackers to siphon huge volumes of email passwords and other sensitive data from multiple governments and private companies. But to date, the specifics of exactly how that attack went down and who was hit have remained shrouded in secrecy. This post seeks to document the extent of those attacks, and traces the origins of this overwhelmingly successful cyber espionage campaign back to a cascading series of breaches at key Internet infrastructure providers.

ComputerWorld Independent

February 15, 2019 admin

CIOs, you’re doing blockchain wrong

Credit to Author: Lucas Mearian| Date: Fri, 15 Feb 2019 03:00:00 -0800

IT leaders who’ve taken the plunge into blockchain are mainly deploying it in proofs-of-concept tests to address the same problems a conventional database could handle, according to research firm Gartner.

To read this article in full, please click here

(Insider Story)

ComputerWorld Independent

February 14, 2019 admin

Mozilla to harden Firefox defenses with site isolation, a la Chrome

Credit to Author: Gregg Keizer| Date: Thu, 14 Feb 2019 11:13:00 -0800

Mozilla plans to boost Firefox’s defensive skills by mimicking the “Site Isolation” technology introduced to Google’s Chrome last year.

Dubbed “Project Fission,” the effort will more granularly separate sites and their individual components than is currently the case in Firefox. The goal: Isolate malicious sites and attack code so individual sites cannot wreak havoc in the browser at large, or pillage the browser, the device or the device’s memory of critical information, such as authentication credentials and encryption keys.

“We aim to build a browser which isn’t just secure against known security vulnerabilities, but also has layers of built-in defense against potential future vulnerabilities,” Nika Layzel, the project tech lead of the Fission team, wrote in a post last week to a Firefox development mailing list. “To accomplish this, we need to revamp the architecture of Firefox and support full Site Isolation.” Layzel also published the note as the first newsletter from the Fission engineering group.

To read this article in full, please click here

ComputerWorld Independent

February 14, 2019 admin

How to use your Mac safely in public places

Credit to Author: Jonny Evans| Date: Thu, 14 Feb 2019 10:59:00 -0800

Coffee shops across the planet are populated by earnest Apple Mac-wielding remote and/or freelance workers – but are they taking steps to protect themselves in a public place? Follow this checklist to make sure you are protected.

12 ways to use your Mac safely in public places

1. Worry about Wi-Fi

Public Wi-Fi networks are dangerous places, not least because you don’t really know how the network is set up or who else is sitting on the same network with you.

Criminals are known to set up legitimate-seeming hotspots on which their software lurks, attempting to take data (including your bank and intranet passcodes) in transit. Please beware:

To read this article in full, please click here

ComputerWorld Independent

February 14, 2019 admin

All about Android upgrades (and why they're late) | TECH(talk)

Credit to Author: Ken Mingis| Date: Thu, 14 Feb 2019 03:00:00 -0800

It’s not exactly news that Android upgrades almost always take a lo-o-o-o-o-ng time to roll out to most users. As in months. Often, many months. Sometimes more than a year.

Sometimes never.

(There is an exception: Google delivers new versions of Android to its Pixel line right away, and did just that with the release of Android 9.0 (Pie) last fall.)

It’s now been six months since Pie arrived, which means it’s time for Computerworld blogger JR Raphael’s comprehensive look at how device-makers are doing when it comes to upgrades.

To read this article in full, please click here

Independent Krebs

February 13, 2019 admin

Bomb Threat Hoaxer Exposed by Hacked Gaming Site

Credit to Author: BrianKrebs| Date: Thu, 14 Feb 2019 05:37:06 +0000

Federal authorities this week arrested a North Carolina man who allegedly ran with a group of online hooligans that attacked Web sites (including this one), took requests on Twitter to call in bomb threats to thousands of schools, and tried to frame various online gaming sites as the culprits. In an ironic twist, the accused — who had fairly well separated his real life identity from his online personas — appears to have been caught after a gaming Web site he frequented got hacked.