Forgot your password?
typodupeerror

Slashdot is powered by your submissions, so send in your scoop

Security

Serious Password Reset Hole In Accellion Secure FTP 27

Posted by Soulskill
from the how-to-annoy-other-users dept.
chicksdaddy writes "A security researcher who was looking for vulnerabilities in Facebook's platform instead stumbled on a much larger hole that could affect scores of firms who rely on a secure file transfer platform from Accellion. Writing on his blog on Monday, Israeli researcher Nir Goldshlager said he discovered the password reset vulnerability while analyzing a Accellion deployment that is used, internally, by Facebook employees. Goldshlager used public knowledge of the Accellion platform to access a hidden account creation page for the Facebook deployment and create a new Facebook/Accellion account linked to his e-mail address. After analyzing Accellion's password reset feature, he realized that — with that valid account — he could reset the password of any other Facebook/Accellion user with some cutting and pasting and a simple HTTP POST request, provided he knew the user's login e-mail address — effectively hijacking the account. Goldshlager said he informed Facebook and that the hole has been patched by Facebook and Accellion. However, other Accellion customers using private cloud deployments of the product could still be vulnerable."
Privacy

Disney Wants To Track You With RFID 278

Posted by timothy
from the disney-himself-just-relaxes-in-the-nitrogen dept.
Antipater writes "Disney parks and resorts have long had a system that combined your room key, credit card, and park ticket into a single card. Now, they're taking it a step further by turning the card into an RFID wristband (called a 'MagicBand'), tracking you, and personalizing your park experience, targeted-ad style. 'Imagine booking guaranteed ride times for your favorite shows and attractions even before setting foot in the park,' wrote Tom Staggs, chairman of Walt Disney Parks and Resorts, in a blog posting on Monday. 'With MyMagic+, guests will be able to do that and more, enabling them to spend more time together and creating an experience that's better for everyone.' Disney does go on to talk about all the things you can opt out of if you have privacy concerns, and the whole system seems to be voluntary or even premium." With a theme park, at least, you can also choose to avoid the place entirely; that makes it, however creepy, a bit different from compulsory education settings, or mandatory car tracking.
Government

AIG Contemplates Joining Stockholder Suit Against US Gov't 354

Posted by timothy
from the just-to-be-on-the-safe-side dept.
inode_buddha writes "After completing its bailout rescue and paying back the money with interest, AIG is considering suing the US Government for doing so. The reasons why? Among other things, the 14% interest rate paid to the government. 'The lawsuit does not argue that government help was not needed. It contends that the onerous nature of the rescue — the taking of what became a 92 percent stake in the company, the deal's high interest rates and the funneling of billions to the insurer's Wall Street clients — deprived shareholders of tens of billions of dollars and violated the Fifth Amendment, which prohibits the taking of private property for "public use, without just compensation." The former CEO and current major shareholder said: "The government has been saying, 'We're your friend, we owned and controlled you and we let you go.' But A.I.G. doesn't owe loyalty to the government," a person close to Mr. Greenberg said. "It owes loyalty to its shareholders."' The lawyer representing him is none other than David Boies of SCO fame."
Crime

Anonymous Helps Find Evidence In Gang Rape Case 436

Posted by timothy
from the sometimes-you're-glad-people-are-dumb dept.
jfruh writes "Evidence of a gang rape committed by members of an Ohio high school football team, including video, was, in the way of digital native teenagers today, put online on various social media sites — and was quickly taken down as students began realizing the magnitude of the situation. The hactivist group Anonymous has been able to find archived and cached versions of the damning content, which may help prosecutors make their case." (The original story from December at the New York Times adds more detail.)
Censorship

Rejection of Reality: Apple Denies Endgame:Syria 172

Posted by timothy
from the sometimes-reality-is-harsh dept.
arclightfire writes "Endgame:Syria billed itself as the first game to cover on ongoing war in a mashup of interactivity and journalism. However it seems like Apple is not happy with this idea, as PocketTactics reports; 'Apple's app guidelines have once again tripped up the release of a strategy game rooted in a real-world conflict. Auroch Digital's Endgame Syria has been rejected by Apple's approvals team for violating guidelines section 15.3, "solely target[ing] a specific race, culture, a real government or corporation, or any other real entity." If section 15.3 sounds familiar, it's because it was the clause invoked when Cupertino said no to Pacific Fleet back in September – the game ran afoul of the guidelines for including Japanese flags in a WWII naval sim.'"
Canada

Proposed Canadian Anti-Spam Rules Restrict Secret ISP Monitoring 24

Posted by timothy
from the shouldn't-they-call-spam-moose? dept.
New submitter Fnordulicious writes "Although Canada's anti-spam legislation is already in place, the rules to implement it have been under development for more than a year. This weekend the proposed rules from the Department of Industry were published in the Canada Gazette. Kady O'Malley reports on the CBC Inside Politics Blog that Canadian ISPs will not be allowed to secretly monitor activity except in the case that the activity is illegal and represents an 'imminent risk to the security of its network.' In addition, consent would be required for monitoring of legal activities 'that are merely unauthorized or suspicious.'"
Government

Postal Service Pilots 'Federal Cloud Credential Exchange' 54

Posted by Unknown Lamer
from the trading-krbtgts dept.
CowboyRobot writes with news about a federal initiative to support federated authentication for government services. From the article: "The U.S. Postal Service will be the guinea pig for a White House-led effort to accelerate government adoption of technologies that allow federal agencies to accept third-party identity credentials for online services. The program involves using services ... through standards like OpenID rather than requiring users to create government usernames and passwords. ... The federated identity effort, known as the Federal Cloud Credential Exchange, is just one piece of a broader Obama administration online identity initiative: the National Strategy for Trusted Identities in Cyberspace (NSTIC), which aims to catalyze private sector-led development of a secure, digital 'identity ecosystem' to better protect identities online. ... The Postal Service pilot is but one of several different pilots that are part of NSTIC. There are also three cryptography pilots and two non-cryptographic privacy pilots in the works. Each of those pilots is being carried out by multiple private sector organizations ranging from the Virginia Department of Motor Vehicles to AOL to AARP to Aetna."
Crime

FBI Publishes Top Email Terms Used By Corporate Fraudsters 105

Posted by Unknown Lamer
from the security-unclassified-uscode-smuggle-espionage dept.
Qedward writes "Software developed by the FBI and Ernst & Young has revealed the most common words used in email conversations among employees engaged in corporate fraud. The software, which was developed using the knowledge gained from real life corporate fraud investigations, pinpoints and tracks common fraud phrases like 'cover up,' write off,' 'failed investment,' 'off the books,' 'nobody will find out' and 'grey area'. Expressions such as 'special fees' and 'friendly payments' are most common in bribery cases, while fears of getting caught are shown in phrases such as 'no inspection' and 'do not volunteer information.'"
Privacy

Loss of a Single Laptop Leads to $50k Fine Against Idaho Hospice 188

Posted by Unknown Lamer
from the sterm-talking-to dept.
netbuzz writes "Losing a single laptop containing sensitive personal information about 441 patients will cost a non-profit Idaho hospice center $50,000, marking the first such HIPAA-related penalty involving fewer than 500 data-breach victims. Yes, the data was not encrypted. 'This action sends a strong message to the health care industry that, regardless of size, covered entities must take action and will be held accountable for safeguarding their patients' health information,' says the Department of Health and Human Services."
Crime

America's Real Criminal Element: Lead 627

Posted by samzenpus
from the is-not-causation dept.
2muchcoffeeman writes "The cause of the great increase in violent crime that started in the 1960s and peaked in the 1990s may have been isolated: lead. This leads directly to the reason for the sharp decline in violent crime since then: lead abatement programs and especially the ban of tetraethyl lead as an anti-knock agent in gasoline starting in 1996. There are three reasons why this makes sense. First, the statistics correlate almost perfectly. Second, it holds true worldwide with no exceptions. Every country studied has shown this same strong correlation between leaded gasoline and violent crime rates. Third, the chemistry and neuroscience of lead gives us good reason to believe the connection. Decades of research has shown that lead poisoning causes significant and probably irreversible damage to the brain. Not only does lead degrade cognitive abilities and lower intelligence, it also degrades a person's ability to make decisions by damaging areas of the brain responsible for emotional regulation, impulse control, attention, verbal reasoning, and mental flexibility. Another thing that stands out: if you overlay a map showing areas with higher incidence of violent crime with one showing lead contamination, there's a strikingly high correlation."
Censorship

Google Gives Up Fight Against Chinese Censorship 96

Posted by samzenpus
from the fighting-is-hard dept.
judgecorp writes "Google has abandoned its policy of warning Chinese users against keywords that trigger censorship. The search giant had added a warning that advised Chinese users not to use search terms that could cause the Chinese authorities to shut off their access to Google, but has now abandoned these warnings. While Google says they were ineffectual, free speech campaigners have expressed disappointment."
Novell

Shareholders Sue Novell Board 37

Posted by samzenpus
from the take-them-to-court dept.
dgharmon writes "If you thought the deal smelled funny back in 2011 when Novell sold itself to Attachmate and its patents to a Microsoft consortium, you are not alone. Some shareholders sued. Specifically, they claim that Novell favored Attachmate over other bidders, especially a 'Party C', and the judge, under Delaware's reasonable 'conceivability' standard, denied summary judgement with respect to the board and decided there will need to be a trial."
Government

TSA 'Secured' Metrodome During Recent Football Game 364

Posted by Soulskill
from the a-large-an-oddly-shaped-airplane dept.
McGruber writes "Travel writer Christopher Elliott touches down with the news that the U.S. Transportation Security Administration was spotted standing around outside a recent American football game between the Minnesota Vikings and the Green Bay Packers (picture). According to Mr. Elliott, the 'TSA goes to NFL games and political conventions and all kinds of places that have little or nothing to do with ... travel. It even has a special division called VIPR — an unfortunate acronym for Visible Intermodal Prevention and Response team — that conducts these searches.' He continues, 'As far as I can tell, TSA is just asking questions at this point. "Data and results collected through the Highway BASE program will inform TSA's policy and program initiatives and allow TSA to provide focused resources and tools to enhance the overall security posture within the surface transportation community," it says in the filing. But they wouldn't be wasting our money asking such questions unless they planned to aggressively expand VIPR at some point in the near future. And that means TSA agents at NFL games, in subways and at the port won't be the exception anymore — they will be the rule.'"
Piracy

Former Leader of Film Piracy Group Sentenced To Five Years In Prison 183

Posted by Soulskill
from the assault-with-a-deadly-upload dept.
colinneagle writes "The acknowledged leader of once prolific movie piracy group IMAGiNE was sent to prison this week for five years, one of the longest sentences ever handed down for criminal copyright infringement. In addition to his prison term, Jeramiah Perkins, 40, of Portsmouth, Va., was sentenced to serve three years of supervised release and ordered to pay $15,000 in restitution. On Aug. 29, 2012, Perkins pleaded guilty to one count of conspiracy to commit criminal copyright infringement. According to the Department of Justice, Perkins was indicted along with three other defendants on April 18, 2012, for their roles in the IMAGiNE Group, an organized online piracy ring that sought to become the premier group to first release Internet copies of movies only showing in theaters. According to court documents, Perkins directed and participated in using receivers and recording devices in movie theaters to secretly capture the audio sound tracks of copyrighted movies. They then synchronized the audio files with illegally recorded video files to create completed movie files suitable for sharing over the Internet via BitTorrent file sharing technology."

"The only way for a reporter to look at a politician is down." -- H.L. Mencken

Working...