Several last weeks the famous Forbes.com portal did not allow readers to get acquainted with the materials if on user side the advertizing disabler is switched on. So, if the reader with AdBlock or uBlock visited Forbes.com, he was asked to move away the disabler. Otherwise to get acquainted with portal content just there was no opportunity. It is difficult to find other opportunity as the same Google does not cache data of a portal correctly.
But a problem not in advertizing and not in disablers. As it appeared after the disabler of advertizing was switched-off by the user, malware under the guise of the normal program was at once offered to it. It was found by the information security specialist Brian Baskin (Brian Baskin) who zaskrinshotit a similar case.
The researcher in the field of a computer security from the Netherlands, Guido Vranken [Guido Vranken] found a new method of attack to the traffic ciphered on TLS/SSL. In the theory he allows to retrieve certain information on the data transferred on the HTTPS protocol. This information then can be used for increase of efficiency of cracking.
The attack called by the researcher of "HTTPS Bicycle Attack" (bicycle attack) allows to determine length of some data transferred in encrypted form: length of heading of kuk, length of the passwords transferred by the POST method, GPS coordinates, the addresses IPv4, etc. At the same time even the traffic which remained in logs gives in to the analysis.
However, to retrieve information on length of fields, it is necessary to foreknow length of some of transmitted data. Besides, attack works only when using the stream cipher.
Having subtracted from authentication heading length length of login, the URL address where the client, and other auxiliary information attacking will become authorized can receive the password length then attack by a trial and error method will become a little more effective.
The Zerodium company declared a prize in $100000 to the one who will find vulnerability of zero day in the new Adobe Flash Player version. In the latest version of the player which left in December protection through isolation of a heap was entered. This method has to increase safety of the program.
The flash-animation player from the Adobe company is famous for bad reputation as one of the least safe programs. In 2015 by amount of vulnerabilities it conceded only to OSes from Apple OS X and iOS. Once very popular and actually only means for use of interactive web animation, now the flash-player gives in to more modern means – for example, to the new HTML5 standard.
The Zerodium company periodically buys from different security experts of the data on vulnerabilities in software products and resells them to government agencies.
Passwords have to be the most difficult, speak about it and write many years. Nevertheless, users turn to similar councils a deaf ear. And it is absolutely vain — can crack not just someone's account from "Vkontaktik", the user can suffer and financially.
The speech here not only about malefactors. For example, the seven-year-old child of the resident of Great Britain remembered the password of the father from Apple ID. Children in general perfectly remember everything and quickly understand, and here, probably, the password still was also not too difficult. Having remembered the password, the bright son got access to finance of the parent.
1 year, 2 months ago
The Yahoo company last week reported that it will warn users about suspicions of shadowing from government services. Twitter, Facebook and Google made it earlier. This initiative is not pleasant to the authorities of Great Britain: they consider the bill under which the head of the company warning about shadowing from the British agencies can go to prison for two years.
Example of the notification from Facebook on the account
1 year, 2 months ago
We welcome readers of the blog iCover! In December of this year the group on fight against cybercrime integrating specialists of Microsoft Cybercrime Center, the Polish bureau CERT, the ESET company, representatives of FBI, Interpol, Europol and other services Computer Emergency Response from several countries performed large-scale operation on neutralization of the botnet Win32/Dorkbot which struck computers of users from more than 200 countries of the world. In article you will find the reference to a small applet of ESET which will allow to check the computer and, if necessary, to delete a malware.
The security expert Karsten Nol (Karsten Nohl), the founder of Security Research Labs, made the statement for vulnerability of the data transfer protocol according to which payment pos-terminals transfer data of cash cards. Employees of Security Research Labs in the face of the surprised correspondent of RT cracked a PIN code of its card and made its clone. At the same time the correspondent used the chipovanny card.
According to Nol the problem consists not in misoperation of devices, and in vulnerabilities of the protocol. In this regard it is necessary to change all system – that is expensive and unprofitable cracking, at least, so far did not purchase mass character.
At the conference 32c3 which was taking place in Hamburg some interesting details of functioning of a North Korean operating system about which already wrote on Habré and Geektimes were sounded. This system is called Red Star. As it appeared, North Korean specialists not for nothing spent so much time for work on this OS (in total about 10 years). In spite of the fact that the system is based on one of the Linux distribution kits, it managed to be made most closed and opaque.
It is not just pale copy of the western operating systems as many of you can solve. The OS was analyzed by specialists of the German company which works in the field of information security. It is interesting that OS managed to be downloaded from the website out of North Korea (as it is known, within the country there is no Network, there is only a limited intranet).
The new anti-terrorist law was adopted by the Chinese authorities despite resistance of a large number of the largest telecommunication companies and counteraction of Washington. Among other requirements, the law obliges telecommunication companies "to provide technical support and the help, including decoding". to the Chinese authorities. As it is reported, it is made to help China to localize and neutralize in time groups of terrorists.
This law does not oblige the companies to provide encrypting keys to the authorities. But access to accounts of users and all correspondence of users, in case of giving of the corresponding request — yes. Such "help" from the companies is considered by the authorities as one of methods of fight against terrorism.