itwbennett writes: On Friday, Oracle published a security advisory recommending that users delete all the Java installers they might have laying around on their computers and use new ones for versions 6u113, 7u97, 8u73 or later. The reason: Older versions of the Java installer were vulnerable to binary planting in the Downloads folder. 'Though considered relatively complex to exploit, this vulnerability may result, if successfully exploited, in a complete compromise of the unsuspecting user's system,' said Eric Maurice, Oracle's software security assurance director, in a blog post.
snydeq writes: InfoWorld's Peter Wayner takes a look at the new services and pricing models that are making cloud computing more powerful, complex, and cheaper than it was a few short years ago. 'We get more, but using it isn't always as simple as it could be. Sure, you still end up on root on some box that's probably running Linux, but getting the right performance out of that machine is more complex,' Wayner writes. "But the real fun comes when you try to figure out how to pay for your planned cloud deployment because there are more options than ever. ... In some cases, the cost engineering can be more complex than the software engineering."
Today, Instagram announced that users will be able to switch between up to five different accounts when using the app on iOS and Android. This new feature will be available later this week, when users download version 7.15 of the app. According to a blog post from the company, "Go to your profile settings to add an additional account. From there, tap your username at the top of your profile to switch between accounts. Once you have multiple accounts added, you'll see your profile photo appear in places throughout the app so you can always tell which one you're using at the moment."
An anonymous reader writes: There's a German security researcher that is arduously testing the installers of tens of software products to see which of them are vulnerable to basic DLL hijacking. Surprisingly, many companies are ignoring his reports. Until now, only Oracle seems to have addressed this problem in Java and VirtualBox. Here's a short (probably incomplete) list of applications that he found vulnerable to this attack: Firefox, Google Chrome, Adobe Reader, 7Zip, WinRAR, OpenOffice, VLC Media Player, Nmap, Python, TrueCrypt, and Apple iTunes. Mr. Kanthak also seems to have paid special attention to antivirus software installers. Here are some of the security products he discovered vulnerable to DLL hijacking: ZoneAlarm, Emsisoft Anti-Malware, Trend Micro, ESET NOD32, Avira, Panda Security, McAfee Security, Microsoft Security Essentials, Bitdefender, Rapid7's ScanNowUPnP, Kaspersky, and F-Secure.
msm1267 writes: Researchers from Kaspersky Lab's Global Research & Analysis Team today unveiled details on two new criminal operations that have borrowed heavily from targeted nation-state attacks, and also shared an update on a resurgent Carbanak gang, which last year, it was reported, had allegedly stolen upwards of $1 billion from more than 100 financial companies. The heaviest hitter among the newly discovered gangs is an ongoing campaign, mostly confined to Russia, known as Metel. This gang targets machines that have access to money transactions, such as call center and support machines, and once they are compromised, the attackers use that access to automate the rollback of ATM transactions. As the attackers empty ATM after ATM—Metel was found inside 30 organizations—the balances on the stolen accounts remained untouched.
Lucas123 writes: With the introduction of 3D or stacked NAND flash memory, non-volatile memory has for the first time surpassed that of hard disk drives in density. This year, Micron revealed it had demonstrated areal densities in its laboratories of up to 2.77 terabits per square inch (Tbpsi) for its 3D NAND. That compares with the densest HDDs of about 1.3Tbpsi. While NAND flash may have surpassed hard drives in density, it doesn't mean the medium has reached price parity with HDDs — nor will it anytime soon. One roadblock to price parity is the cost of revamping existing or building new 3D NAND fabrication plant, which far exceeds that of hard drive manufacturing facilities, according to market research firm Coughlin Associates. HDD makers are also preparing to launch even denser products using technologies such as heat assisted magnetic recording.
itwbennett writes: On Sunday, the name, title, email address, and phone number of more than 9,000 DHS employees, with titles ranging from engineers, to security specialists, program analysts, InfoSec and IT, all the way up to director level was posted on Twitter. 'The account went on to claim that an additional data dump focused on 20,000 FBI employees was next,' writes CSO's Steve Ragan. The hacker told Motherboard that the data was obtained by "compromising the email account of a DoJ employee, although he would not elaborate on how that account was accessed in the first place."
New submitter Iamthecheese points to an article which says that a patch published on the Linux Kernel Mailing List indicates that AMD's forthcoming Zen processors will have as many as 32 cores per socket, but notes that while the article's headline says "Confirms," "the article text doesn't bear that out." Still, he writes, There are hints of such from last year. A leaked patch for the 14 nanometer AMD Zeppelin (Family 17h, Model 00h) reveals support for up to 32 cores. Another blog says pretty much the same thing. We recently discussed an announced 4+8 core AMD chip, but nothing like this.
An anonymous reader writes: A new backdoor trojan is making the rounds, coming equipped with features that allow it to steal files, take screengrabs, and record Skype conversations. Currently detected targeting US organizations, researchers linked it to previous malware developed by a Chinese cyber-espionage group called Admin@338. Besides recording Skype conversations, the malware can also steal Office documents, and includes a complicated installation procedure that allows it to avoid antivirus software installed on the machine.
The Financial Times reports that Google isn't going to let the VR hardware wars fall to the likes of Samsung and Oculus; instead, it's working on a (cardboard-free) VR headset of its own, to be released in conjunction with Android VR software intended not only to make Android more VR friendly in general but specifically to help developers reduce nausea-inducing lag. The report doesn't quite come out of the blue, considering that Google has shipped more than 5 million of its own Cardboard viewer already, and has several projects dealing with VR infrastructure, either directly (like Jump) or indrectly (like Project Tango). Google (or Alphabet) has proven itself a hardware behemoth, not just the "search giant" it's so often called in news stories, and of late seems to be more interested in making its footprint in hardware a bit firmer.
AmiMoJo writes: Four years ago Mozilla moved to a fixed-schedule release model, otherwise known as the Train Model, in which we released Firefox every six weeks to get features and updates to users faster. Now Mozilla is moving to a variable 6-8 week cycle, with the same number of releases per year but some flexibility to 'respond to emerging user and market needs' and allow time for holidays. The new release schedule looks like this:
- 2016-01-26 – Firefox 44
- 2016-03-08 – Firefox 45, ESR 45 (6 weeks cycle)
- 2016-04-19 – Firefox 46 (6 weeks cycle)
- 2016-06-07 – Firefox 47 (7 weeks cycle)
- 2016-08-02 – Firefox 48 (8 weeks cycle)
- 2016-09-13 – Firefox 49 (6 weeks cycle)
- 2016-11-08 – Firefox 50 (8 weeks cycle)
- 2016-12-13 – Firefox 50.0.1 (5 week cycle, release for critical fixes as needed)
- 2017-01-24 – Firefox 51 (6 weeks from prior release)
itwbennett writes: [The Neutrino exploit kit] is using passive OS fingerprinting to detect visiting Linux machines, according to Trustwave researchers who found that computers they were using for research couldn't make a connection with servers that delivered Neutrino. Daniel Chechik, senior security researcher at Trustwave's SpiderLabs division wrote that they tried changing IP addresses and Web browsers to avoid whatever was causing the Neutrino server to not respond, but it didn't work. But by fiddling with some data traffic that Trustwave's computers were sending to the Neutrino server, they figured out what was going on.
An esteemed reader writes: Curious about the various telemetry and personal information being collected by Windows 10, one user installed Windows 10 Enterprise and disabled all of the telemetry and reporting options. Then he configured his router to log all the connections that happened anyway. Even after opting out wherever possible, his firewall captured Windows making around 4,000 connection attempts to 93 different IP addresses during an 8 hour period, with most of those IPs controlled by Microsoft. Even the enterprise version of Windows 10 is checking in with Redmond when you tell it not to — and it's doing so frequently.
An anonymous reader writes: archive.org has launched a Museum of Malware, which devotes itself to a historical look at DOS-based viruses of the 1980s and 1990s, and gives viewers the opportunity to run the viruses in a DOS game emulator, and to download 'neutered' versions of the code. With an estimated 50,000 DOS-based viruses in existence by the year 2000, the Malware Museum's 65 examples should be seen as representative of an annoying, but more innocent era of digital vandalism.
New submitter Tenebrousedge writes: Docker container sizes continue a race to the bottom with a couple of environments weighing in at less than 10MB. Following on the heels of this week's story regarding small images based on Alpine Linux, it appears that the official Docker images will be moving from Debian/Ubuntu to Alpine Linux in the near future. How low will they go?
An anonymous reader writes: Just two days after Comodo's Chromodo browser was publicly shamed by Google Project Zero security researcher Tavis Ormandy, it's now Avast's turn to be publicly scorned for failing to provide a "secure" browser for its users. Called SafeZone, and also known as Avastium, Avast's custom browser is offered as a bundled download for all who purchase or upgrade to a paid version of Avast Antivirus 2016. This poor excuse of a browser was allowing attackers to access files on the user's filesystem just by clicking on malicious links. The browser wouldn't even have to be opened, and the malicious link could be clicked in "any" browser.
TheRealHocusLocus writes: Three Decembers ago I lauded the impending death of the trapezoid. Celebration of the rectangle might be premature however, because in the rush-to-market an appalling number of chargers, cables and legacy adapters have been discovered to be non-compliant. There have been performance issues with bad USB implementation all along, but now — with improved conductors USB-C offers to negotiate up to 3A in addition the 900ma base, so use of a non-compliant adapter may result in damage. Google engineer and hero Benson Leung has been waging a one-man compliance campaign of Amazon reviews to warn of dodgy devices and praise the good. Reddit user bmcclure937 offers a spreadsheet summary of the reviews. It's a jungle out there, don't get fried.
An anonymous reader writes: Tests were carried out at Phoronix of all Ubuntu Long-Term Support releases from the 6.06 "Dapper Drake" release to 16.04 "Xenial Xerus," looking at the long-term performance of (Ubuntu) Linux using a dual-socket AMD Opteron server. Their benchmarks of Ubuntu's LTS releases over 10 years found that the Radeon graphics performance improved substantially, the disk performance was similar while taking into account the switch from EXT3 to EXT4, and that the CPU performance had overall improved for many workloads thanks to the continued evolution of the GCC compiler.
David Rothman writes: The Thin Helvetica Syndrome arises from the latest Kindle upgrade and has made e-books less readable for some. In the past, e-book-lovers who needed more perceived-contrast between text and background could find at least partial relief in Helvetica because the font was heavy by Kindle standards. But now some users complain that the 5.7.2 upgrade actually made Helvetica thinner. Of course, the real cure would be an all-text bold option for people who need it, or even a way to adjust font weight, a feature of Kobo devices. But Amazon stubbornly keeps ignoring user pleas even though the cost of adding either feature would be minimal. Isn't this supposed to be a customer-centric company?
jones_supa writes: Paolo Valente from University of Modena has submitted a Linux kernel patchset which replaces CFQ (Completely Fair Queueing) I/O scheduler with the last version of BFQ (Budget Fair Queuing, a proportional-share scheduler). This patchset first brings CFQ back to its state at the time when BFQ was forked from CFQ. Paolo explains: "Basically, this reduces CFQ to its engine, by removing every heuristic and improvement that has nothing to do with any heuristic or improvement in BFQ, and every heuristic and improvement whose goal is achieved in a different way in BFQ. Then, the second part of the patchset starts by replacing CFQ's engine with BFQ's engine, and goes on by adding current BFQ improvements and extra heuristics." He provides a link to the thread in which it is agreed on this idea, and a direct link to the e-mail describing the steps.