'Silent but deadly' Java security update breaks legacy apps - dev

An application developer reports that the latest Java 7 update "silently" deletes Java 6, breaking applications in the process.

Java 7 update 11 was released two weeks ago to deal with an unpatched vulnerability which had gone mainstream with its incorporation into cybercrook toolkits such as the Blackhole Exploit Kit in the days beforehand. Attacks were restricted to systems running Java browser add-ons.

Patent Term Calculations: District Courts Split on PTA Calculations; Revive Focus on Deference to PTO Determinations

By Dennis Crouch

Exelixis v. Kappos (Exelixis II) (E.D. Va. 2013)

We now have a district court split on post-RCE patent term adjustment. This decision – siding with the PTO – arises from a second Exelixis case and will be called Exelixis II (Brinkema, J.) In Exelixis I, Judge T.S. Ellis sided with the patentee in finding that the PTO was improperly under-calculating the patent term owed to patentees who had filed a request-for-continued examination during the course of prosecution. Exelixis v. Kappos, — F. Supp. 2d —, 2012 WL 5398876 (E.D. Va. Nov. 1, 2012), as amended Nov. 6, 2012. In the parallel caes of Novartis AG v. Kappos, — F. Supp. 2d --, 2012 WL 5564736 (D.D.C. Nov. 15, 2012), Judge Huvelle adopted the reasoning of Judge Ellis in siding with the patentee. Those decisions basically held that "once the three year clock has run, PTA is to be awarded on a day for day basis regardless of subsequent events." The PTO has argued that an RCE stops the running of the PTA clock.

Best Super Bowl Commercial So Far

Smartphone Wars: Micron’s Slide-to-Unlock Patent

by Dennis Crouch

Adding a bit of drama to the slide-to-unlock debate, Micron has just received its own patent covering a "system and method for controlling user access to an electronic device." U.S. Patent No 8,352,745 issued in January 2013 but claims priority to an original application filed in February 2000 and lists Jim McKeeth as inventor.

Claims:

1. A system comprising:

a touch screen upon which a user is to enter, by drawing, a geometric pattern in a specified direction to gain access to the system; and

a processing circuit coupled to the touch screen to compare the user entered geometric pattern to a predefined geometric pattern stored in a memory.

6. The system of claim 1 wherein the user entered geometric pattern is a line.

Apple's slide-to-unlock patents claim priority only to the 2004-2005 timeframe and, although they may be separately patentable, Apple's patents will not serve to invalidate Micron's new patent.

Samsung has a 10-year cross-license deal with Micron. I have not seen reports of any similar deals with Apple, Google\Motorola, or RIM. It will be interesting to see whether Micron holds onto the patent or shifts it two an enforcement company as it did in 2010 in sending 4,000+ patents to John Desmarais for enforcement. Micron is a major manufacturer of computer memory with a market valuation of about $8 billion, perhaps they should just ask for Apple to endorse-over its recent billion dollar patent infringement judgment. One complicating factor is that I suspect Micron is a supplier for all of the potential defendants.

Brisbane online flood maps woefully inadequate

As floods sweep over South-East Queensland for the second time in two years, Premier Campbell Newman took to the airwaves on 27 January advising citizens to “look at their flood maps” to decide whether they were at risk.

To quote News Limited: “residents should check flood maps which would be released on council floods maps [for Brisbane and Ipswich] later tonight.”

Being of an inquiring mind, The Register decided to take that advice, even though Vulture South is nowhere near the floods. And here’s what we find.

The end of the line for Symbian

Buried deep within Nokia's press release about its financial results, there's a line that pretty much signals the end of one of the most popular and successful mobile operating systems in history. With Nokia retiring its use, Symbian is no more.
Symbian wasn't only incredibly successful, it's also incredibly old. Many people think Symbian originated at Psion as EPOC, but that's not entirely true. Technically speaking, Symbian is EPOC32, which is a different operating system than EPOC. EPOC was written in 8086 assembler and C, and powered many of Psion's PDAs, including the Series 3a pictured below. This thing is a joy to use, actually, even though it's from 1993 and uses a 8086. The built-in spell checker is pretty amazing, and quite fast.
EPOC32 is EPOC's (renamed to EPOC16 or SIBO to distinguish it from EPOC32) successor, and was written in C++. It was a completely new operating system, and introduced features to Psion's PDAs such as pre-emptive multitasking and memory protection, and left the 8086 behind in favour of ARM processors. It was first released in 1997.

Source: 

OS News

Fujitsu developing HTML5-based security app for corporate smart phones

Engineers at Fujitsu Laboratories are developing an HTML5-based platform for smart phones that designed to keep corporate data secure when accessed from employee-owned handsets.
The system, which Fujitsu plans to launch later this year, is one of a number that addresses this increasingly common problem: how to allow workers access to corporate IT systems while avoiding deliberate or inadvertent leaks of data from devices that are not totally under the company's control.
Fujitsu's system matches an app on the phone with a cloud-based server that delivers corporate apps such as email, sales databases and customer contacts, as HTML5 applications. The phone app senses whether it is in the workplace or not and therefore whether it has access to corporate data. The cloud apps are delivered over an encrypted connection to the handset, which runs them inside a secure application environment on the phone.

Source: 

Tech Central (Ireland)

Graph Search raises privacy concerns from security experts

Facebook's new Graph Search has security experts warning people who use the social network to raise their privacy settings in order to avoid embarrassment or becoming victims of cybercriminals.
Graph Search, which Facebook introduced this month and is rolling out gradually, lets people use naturally phrased queries, such as "Mexican restaurants my friends like," and receive personalized results. The service makes a lot more useful information available to people, and it gives Facebook a new venue for selling advertising.
Unfortunately, while better search is good for Facebook and its users, it also brings more opportunities for scammers and potential embarrassment for people who are careless about their privacy settings.  Tom Scott posted on the microblogging and social networking site Tumblr queries that returned results that few people would want to be a part of. They included "married people who like prostitutes" and "current employers of people who like racism."

Source: 

PC World

Improving signal-to-noise in risk management

One of the most important responsibilities of the information security professional (or any IT professional, for that matter) is to help management make well-informed decisions. Unfortunately, this has been an elusive objective when it comes to risk. Although we’re great at identifying control deficiencies, and we can talk all day long about the various threats we face, we have historically had a poor track record when it comes to risk. There are a number of reasons for this, but in this article I’ll focus on just one -- definition.
You’ve probably heard the old adage, “You can’t manage what you can’t measure.”  Well, I’d add to that by saying, “You can’t measure what you haven’t defined.” The unfortunate fact is that the information security profession has been inconsistent in how it defines and uses the term “risk.” Ask a number of professionals to define the term, and you will get a variety of definitions.
Besides inconsistency, another problem regarding the term “risk” is that many of the common definitions don’t fit the information security problem space or simply aren’t practical. For example, the ISO27000 standard defines risk as, “the effect of uncertainty on objectives.” What does that mean?

Source: 

ZDNet

Week in review: Backdoors in Barracuda appliances, and what makes a good information security professional?

Here's an overview of some of last week's most interesting news, reviews, videos, interviews and articles:

Newest Java update doesn't fix fresh critical vulnerabilities
A little after the latest Java update was released, Adam Gowdiak, CEO of Polish firm Security Explorations had piped up to say that it left a number of critical security flaws unpatched - a claim that he reiterated last Friday on the Full Disclosure mailing list.

What makes a good information security professional?
Information security is a very competitive industry, and one of the very few that kept doing fine even during the recession. It's also a dynamic field that promises a lot of fascinating work, so it's no wonder that so many individuals want to break into it.

Polish CERT hits Virut botnet
The Polish Research and Academic Computer Network (NASK), the national registry of the .pl domain and founder of CERT Polska, has announced that they took over 23 domains that served as C&C servers for the Virut botnet.

Cyber security needs to be a board level issue
As part of the much talked about Cyber Security Strategy, the UK Government is “committed to helping reduce vulnerability to attack and ensure that the UK is the safest place to do business”. One strand of the strategy was an executive briefing, which targeted the most senior levels in the UK’s largest companies and provided them with advice on how to safeguard their most valuable assets, such as personal data, online services and intellectual property.

Skype becomes a malware minefield
Skype users should be careful when using the service these days. First CSIS researchers unearthed a campaign misusing Skype to replicate and spread the Shylock banking Trojan, then Trend Micro researchers discovered highly dangerous worms also being propagated via Skype messages containing malicious links.

Investigating clever scamming techniques and their evolution
Christopher Boyd is a Senior Threat Researcher for GFI Software. Chris has been credited for finding the first instance of a rogue Web browser installing without permission, the first Twitter DIY botnet kit, and the first rootkit in an IM bundle. In this interview he talks about cunning scamming techniques and their evolution.

Google searching for hardware alternatives to passwords
Passwords are on the way out, it seems. With current boom - and obvious success - of phishing, it's time to see what could be a better alternative to this flawed solution. Despite having considerable success with the two-step login authentication option made available to its customers, Google is looking in the direction of hardware authentication.

How to spot APT attacks
With the proliferation of Advanced Persistent Threats (APTs), it's paramount for those who are charged with defending the systems and networks of likely targets to know that these attackers often utilize legal and common tools whose use is more difficult to spot by forensic investigations.

Twitter bug gives 3rd-party apps access to users' Direct Messages
A Twitter bug allowed third-party applications to access Direct Messages of users who signed in to the apps by using their Twitter account, reported IOActive researcher Cesar Cerrudo.

Augmented Reality: An Emerging Technologies Guide to AR
ugmented Reality is not the stuff of science fiction any more, and we should all be at least familiar with its current and likely future uses. This book aims to be an easy-to-digest guide on the subject matter.

Employees targeted with fake DocuSign "confidential message"
An email purportedly sent by the DocuSign Electronic Signature Service on behalf of the administrative departments of a wide variety of organizations and businesses is hitting the inboxes of their employees, Bitdefender warns.

DNS attacks increase by 170%
Radware identified a number of new attack methods representative of today’s increasingly sophisticated and severe DDoS threat. Their latest report highlights server-based botnets and encrypted layer attacks as just two of the new attack tools challenging organizations during DDoS attacks.

Most exploit kits originated in Russia, say researchers
58 percent of the vulnerabilities targeted by the most popular exploit kits in Q4 were more than two years old and 70 percent of exploit kits reviewed were released or developed in Russia, reveals Solutionary SERT's Q4 2012 Quarterly Research Report.

Jobs offered to student kicked out of college for discovering security flaw
Ahmed Al-Khabaz, the student that has been expelled from Dawson College because of an unauthorized intrusion in the college's systems to check whether a flaw he recently discovered in its student web portal was fixed, has not been reinstated.

The arrival of the post-PC threat era
Trend Micro's Annual Security Roundup shows that most of our predictions for 2012 have come true, and we encapsulate 2012 as the year where threats launched the beginning of the post-PC era. Threats have now escalated past the desktop environment.

People need help controlling personal info online
Microsoft released new data reflecting consumers' perceptions about how their information is used online and a new series of short videos to help people better manage their online privacy.

Video: Practical exploitation of embedded systems
This video from Hack in The Box conference is an in-depth exploration of the reverse engineering and exploitation of embedded systems.

Barracuda Networks confirms exploitable backdoors in its appliances
The backdoor accounts are present on in all available versions of Barracuda Spam and Virus Firewall, Web Filter, Message Archiver, Web Application Firewall, Link Balancer, Load Balancer, and SSL VPN appliances.

Watering hole campaign targeting "Reporters without Borders" visitors
Watering hole attacks continue unabated and, according to Avast's Director of Threat Intelligence Jindrich Kubec, the finger could be safely pointed to China once again.

Top five hurdles to security and compliance in industrial control systems
For many decades, Industrial Control Systems (ICS) have been the operational systems relied upon to safely and reliably deliver the essentials of daily life. Sometimes referred to as a Critical Infrastructure, they are the backbone of a modern economy. With these systems generally working well, there has been little need to make major changes to them. There has been innovation and some incremental changes, but in the ICS world, it has largely been ‘business as usual.’

SCADA password cracking code available
ICS-CERT has issued an alert about the existence and general availability of the proof-of-concept exploit code for a tool that can brute force passwords and thus gain access and control of programmable logic controllers (PLCs).

How to avoid Facebook scams and limit the damage they make
What should users who have fallen for Facebook scams do to minimize the danger to themselves and others, and what they can do to stop falling for similar ones in the future - or at all.

GitHub's new search reveals passwords and private keys
GitHub has unveiled a new search infrastructure that should help coders find specific code within the millions of the individual repositories GitHub hosts. But, as helpful as this tool promises to be, it can still be misused. And unfortunately, it didn't take long to prove that, as only hours later a number of individuals realized that quite a few careless coders inadvertently published their private encryption keys or their passwords in their repository.

RSA introduces disaster recovery and crisis management solution

RSA, the Security Division of EMC, introduced two additions to its RSA Archer product suite designed to help customers meet ever changing and comprehensive business continuity, disaster recovery and crisis management demands. 


RSA Archer Business Continuity Management and Operations is one of the industry's most tightly integrated solutions designed to address business continuity, disaster recovery and crisis management. Engineered to align with BS25999, NIMS and ISO 22301, it offers a standards-based approach to business continuity planning. 

People need help controlling personal info online

Microsoft released new data reflecting consumers' perceptions about how their information is used online and a new series of short videos to help people better manage their online privacy.

According to the results of a Microsoft-commissioned survey of 1,000 U.S. adults, people feel they have little to no control about how their data may be collected by online companies. They are also increasingly in search of trusted sources of information to help them make better choices about their online privacy.

Highlights of the research include the following:
Forty-five percent said they feel they have little or no control over the personal information companies gather about them while they are browsing the Web or using online services, such as photo-sharing, travel or gaming.
Four in 10 said they feel they totally or mostly understand how to protect their online privacy.
An equal number of people (39 percent) said they are turning to friends and family, as well as company privacy statements, as their top source for privacy information.
A third of those surveyed (32 percent) said they are paying attention to companies' privacy reputations, track records and policies when choosing which websites to visit or services to use.
"As online activities have become a valuable part of daily life, privacy is incredibly important. At Microsoft, we strive to help our customers manage their personal information online by providing easy-to-understand privacy policies, settings and guidance," said Brendon Lynch , chief privacy officer, Microsoft.

"We take seriously our responsibility to customers by investing in a comprehensive and dynamic privacy program that implements our policies and delivers privacy innovations to our customers," Lynch added.

IT challenges with managing increasing amounts of data

Half of all organizations EVault surveyed in the USA, UK, France, Germany, and the Netherlands say they are managing more data now than they were a year ago, and 70 percent of those same organizations expect that the volumes of data they manage will only continue to climb.



Faced with these realities, the survey found that within the group of IT leaders not currently benefiting from a hybrid (onsite and offsite) data protection environment, more than 60 percent are either planning or considering one. Cloud backup and storage, a key component of hybrid environments, is now seen as an important way to manage the ever-increasing volumes of data.

66 percent of IT people surveyed said their organizations will increase the amount of data they store in the cloud by 2015. The US is most bullish about storing data in the cloud, with 85 percent of American IT leaders responding they would increase cloud usage in the next few years.

Within organizations already benefiting from a hybrid data protection environment, 74 percent report they needed the increased flexibility a hybrid approach brings to their data management infrastructure, which becomes more and more important as data volumes increase.

Improved data security was why 66 percent moved from their old backup and recovery tools to an onsite and offsite data protection solution. 57 percent of all IT leaders surveyed prefer their hybrid solution because their rapidly growing business critical data requires protection against natural disaster and theft.

While year-over-year and country-by-country figures of employees storing company data on their phones held steady at 22 percent (in the US it is up to 32 percent), an overwhelming majority of IT leaders — 94 percent — have concerns about the mix of personal and corporate data used by employees on their own mobile devices. 

7 percent of IT leaders surveyed expressed concerns about the retention and security of their data, and its possible deletion from a mobile device. Meanwhile, an additional 57 percent highlighted worries about the legal issues that could stem from the BYOD (bring your own device) trend.

IT leaders in this study are just starting to address the issue. While almost all of the organizations surveyed – 96 percent – have at least some employees who have mobile devices they use for work, and 24 percent of IT leaders themselves admit to having lost data from a mobile device, only 28 percent of organizations surveyed currently have a disaster recovery plan which includes mobile devices.

IT appears ready to start addressing this problem, with a large number of respondents believing they would benefit from implementing some policy controls. For example, 55 percent of those surveyed believe their organization would benefit from administrative controls enabling the ability to delete data from any mobile device possessing company data.

Video: Practical exploitation of embedded systems

This video from Hack in The Box conference is an in-depth exploration of the reverse engineering and exploitation of embedded systems.

It covers hardware by showing how to identify and probe debugging and I/O ports on undocumented circuit board layouts. The authors discuss software by exploring the analysis, reverse engineer and binary patching techniques for obscure real time OSes and firmware images with real world examples.

Infoblox unveils new solutions for security, availability and automation

Infoblox announced new products enable organizations to manage the demands put on their networks by BYOD, cloud computing, migration to IPv6 and the evolving cyber-threat landscape.


The new Infoblox DNS Firewall, Infoblox Security Device Controller, and Infoblox Trinzic 100 Network Edge Services Appliance deliver on the company’s strategy to help customers create a strategic control point in the network. The new products are integrated with the latest Infoblox portfolio of market-leading solutions for network control.

Users targeted with phishing scam via Facebook messages

Facebook users are advised to be on the lookout for bogus personal messages supposedly sent by the Facebook Security Team.

The message claims that the users' account has been reported for violating "policies that are considered annoying or insulting Facebook users," and that they have to "reconfirm" their account within 24 hours if they don't want it to be disabled.

Sony fined £250,000 for 2011 Playstation Network breach

The UK Information Commissioner's Office has fined Sony £250,000 for failing to adequately protect UK gamers' personal and possibly even financial information following the 2011 breach of its Playstation Network. 


The ICO investigation found that the attack could have been prevented if the software had been up-to-date, as appropriate updates were available.

Watering hole campaign targeting "Reporters without Borders" visitors

Watering hole attacks continue unabated and, according to Avast's Director of Threat Intelligence Jindrich Kubec, the finger could be safely pointed to China once again.

The latest website compromised to redirect visitors to sites serving exploits for the recently patched IE zero-day vulnerability and two Java flaws (CVE-2013-0422 and CVE-2011-3544) is the official site of Reporters Without Borders (Reporters sans Frontières), an international non-governmental organization advocating freedom of the press and freedom of information.

Barracuda Networks confirms exploitable backdoors in its appliances

Barracuda Networks has released firmware updates that remove SSH backdoors in a number of their products and resolve a vulnerability in Barracuda SSL VPN that allows attackers to bypass access restrictions to download potentially insecure files, set new admins passwords, or even shut down the device.

The backdoor accounts are present on in all available versions of Barracuda Spam and Virus Firewall, Web Filter, Message Archiver, Web Application Firewall, Link Balancer, Load Balancer, and SSL VPN appliances.

Security intelligence solutions for mobile technology providers

Webroot announced the availability of a portfolio of internet security solutions that give mobile technology providers – from carriers to device manufacturers to mobile device management (MDM) companies – easily deployable and cost-effective services to make security an integral part of their own offerings.

The Webroot Security Intelligence for Mobile Suite draws on the power of the Webroot Intelligence Network (WIN), the world's most comprehensive cloud-based security intelligence service, to deliver the most advanced threat defense to tablets and smartphones.