Quantum Encryption Makes Credit Cards Fraud-Proof

Credit card frauds are very common these days – today a data breach occurs in retailer’s shop, online shopping site or banking site and at the next moment millions of cards appears in the underground black market – how simple is that for cyber criminals nowadays.

But imagine if there is no possible way to hack credit cards and ID cards. Seems like next to impossible, but quantum cryptography ensures that stealing people’s personal data will soon be very difficult for hackers and cyber thieves due to an extra layer of verification.

The research at the University of Twente in Enschede, Netherlands has suggested that “fraud-proof” credit cards are possible to develop using Quantum Physics that will protect users’ financial and personal information from hackers. Security researchers describe this extra layer of verification as Quantum-Secure Authentication (QSA) of a “classical multiple-scattering key.”

With the help of QSA method, people will be able to create a physical “key” which is impossible to copy or create similar ones. So, this new technology will not allow any person to copy someone’s credit card and can validate the identity of any person or object, including debit and credit cards, even if the most important data has been stolen, the Optical Society reported in the Dec. 15, 2014 edition of the journal Optica.

However, Chip-and-Pin payment cards are opted by the major organisations to promote additional security solutions like tokenization and point-to-point encryption. Chip technology generates a unique code for every transaction, making it nearly impossible for criminals to use the card for counterfeit fraud. But we have also seen that the latest “Chip-and-PIN” technology are vulnerable to Card Cloning.

Now, the important thing to note is that how is it possible and how Quantum Physics works with the Credit card technology ??

This innovative technology depends on two unique quantum properties of light to create a secure and unique Question-and-Answer (Q&A) exchange that cannot be ‘spoofed’ or copied. As a single photon of light can occupy more than one location at the same time and because light has so many separate wavelengths that hacking a credit card would take centuries to find the right combination.

“Single photons of light have very special properties that seem to defy normal behavior,” said a study lead author Pepijn Pinkse of the University of Twente’s MESA and Institute for Nanotechnology. “When properly harnessed, they can encode information in such a way that prevents attackers from determining what the information is.“

The “quantum credit cards” would be more secure and fraud-proof because QSA technology leverages the immutable properties of quantum mechanics to create a perfectly secure encryption system, instead of any mathematical interpretation.

According to Pepijn Pinkse, such a security layer would be “straightforward to implement with current technology,” used by credit cards.

Quantum credit cards would be outfitted with a strip of white paint containing millions of nanoparticles. Researchers could project individual photons of light onto this paint with the help of a laser that would bounce around the nanoparticles as if in a pinball machine before escaping back to the surface and forming a unique pattern.

“It would be like dropping 10 bowling balls onto the ground and creating 200 separate impacts. It’s impossible to know precisely what information was sent (what pattern was created on the floor) just by collecting the 10 bowling balls,” researcher said.

This new technology could help in protecting government buildings, personal bank and credit cards, and even vehicles, according to the research.

Hackers Can Read Your Private SMS and Listen to Phone Calls

Security researchers have discovered a massive security flaw that could let hackers and cybercriminals listen to private phone calls and read text messages on a potentially vast scale – no matter if the cellular networks use the latest and most advanced encryption available.

The critical flaw lies in the global telecom network known as Signal System 7 that powers multiple phone carriers across the world, including AT&T and Verizon, to route calls, texts and other services to each other. The vulnerability has been discovered by the German researchers who will present their findings at a hacker conference in Hamburg later this month.

“Experts say it’s increasingly clear that SS7, first designed in the 1980s, is riddled with serious vulnerabilities that undermine the privacy of the world’s billions of cellular customers,” said The Washington Post, which first uncovered flaws in the system earlier this year.

SS7 or Signaling System Number 7 is a protocol suite used by most telecommunications operators throughout the world to communicate with one another when directing calls, texts and Internet data. It allows cell phone carriers to collect location information from cell phone towers and share it with each other. A United States carrier will find its customer, no matter if he or she travels to any other country.

According to the security researchers, the outdated infrastructure of the SS7 makes it very easy for hackers to hack, as it is loaded with some serious security vulnerabilities which can lead to huge invasions of privacy of the billions of cellular customers worldwide.

“The flaws discovered by the German researchers are actually functions built into SS7 for other purposes – such as keeping calls connected as users speed down highways, switching from cell tower to cell tower – that hackers can repurpose for surveillance because of the lax security on the network,” the report reads.

So far, the extent of flaws exploited by hackers have not been revealed, but it is believed that using the flaws hackers can locate or redirect users’ calls to themselves or anywhere in the world before forwarding to the intended recipient, listen to calls as they happen, and record hundreds of encrypted calls and texts at a time for later decryption.

No matter how much strong or advanced encryption the carriers are using, for example AT&T and Verizon use 3G and 4G networks for calls, messages, and texts sent from people within the same network, but the use of that old and insecure SS7 for sending data across networks the backdoor open for hackers.

Not just this, use of SS7 protocol also makes the potential to defraud users and cellular carriers, according to the researchers.

The American Civil Liberties Union (ACLU) has also warned people against using their handset in light of the breaches.

“Don’t use the telephone service provided by the phone company for voice. The voice channel they offer is not secure,” principle technologist Christopher Soghoian told Gizmodo. “If you want to make phone calls to loved ones or colleagues and you want them to be secure, use third-party tools. You can use FaceTime, which is built into any iPhone, or Signal, which you can download from the app store. These allow you to have secure communication on an insecure channel.”

Soghoian also believes that security agencies – like the United states’ NSA and British security agency GCHQ – could be using these flaws. “Many of the big intelligence agencies probably have teams that do nothing but SS7 research and exploitation. They’ve likely sat on these things and quietly exploited them,” he said.

China fingered for Afghan Govt attacks

Aussie embassy among Govt websites serving malware

Chinese hackers have targeted nearly all major Afghanistan Government websites by hacking an official content delivery network (CDN) and gaining a foothold to attack western governments.
Hackers popped the network run by the Afghan Ministry of Communications and IT which delivered malware to many of the Government's websites including the Australian embassy.
Afghanistan's agencies for finance, education and justice were among the nine listed as falling victim to the attack, according to ThreatConnect researchers who found the watering hole attacks closely coincided with a meeting on infrastructure development and bilateral cooperation in Kazakstan between China's Prime Minister Li Keqiang and Afghanistan's government chief executive officer Abdullah Abdullah.
The researchers said an image used to serve the malware was modified only hours after it appeared to be taken at the meeting.

Such a hack would be of interest to China, researchers said, given that the country is building regional influence and might see an opportunity in the vacuum of the West's military withdrawal from Afghanistan.
Beijing is also building transport infrastructure in the region and facilitating multilateral peace talks with the Taliban under its South Asian strategy.
"By exploiting and co-opting Afghan network infrastructure that is used by multiple ministerial level websites, Chinese intelligence services would be able to widely distribute malicious payloads to a variety of global targets using Afghanistan's government websites as a topical and trusted distribution platform, exploiting a single hidden entry point," the threat intelligence team (TSIRT) wrote in an advisory.
"This being a variant of a typical watering-hole attack, the attackers will most likely infect victims outside the Afghan government who happened to be browsing any one of the CDN client systems, specifically, partner states involved in the planned troop reduction."
Naming conventions used in the Afghanistan attack dubbed Operation Helmand were similar to those in East Asia hacking operations.
The attack also bore similarities to a June watering hole attack in which a malicious Java file was served on the website of the Greece embassy in Beijing during a diplomatic meeting to Athens.
The team warned enterprises to monitor content delivery networks and ensure server response headers were configured to push third party content from narrow white lists.

Hack attack causes 'massive damage' at steel works

 

The hack attack led to failures in plant equipment and forced the fast shut down of a furnace

A blast furnace at a German steel mill suffered "massive damage" following a cyber attack on the plant's network, says a report.

Details of the incident emerged in the annual report of the German Federal Office for Information Security (BSI).
It said attackers used booby-trapped emails to steal logins that gave them access to the mill's control systems.
This led to parts of the plant failing and meant a blast furnace could not be shut down as normal.
The unscheduled shutdown of the furnace caused the damage, said the report.
In its report, BSI said the attackers were very skilled and used both targeted emails and social engineering techniques to infiltrate the plant. In particular, said BSI, the attackers used a "spear phishing" campaign aimed at particular individuals in the company to trick people into opening messages that sought and grabbed login names and passwords.
The phishing helped the hackers extract information they used to gain access to the plant's office network and then its production systems.
Once inside the steel mill's network, the "technical capabilities" of the attackers were evident, said the BSI report, as they showed familiarity with both conventional IT security systems but also the specialised software used to oversee and administer the plant.
BSI did not name the company operating the plant nor when the attack took place. In addition, it said it did not know who was behind the attack nor what motivated it.
The attack is one of only a few on industrial systems known to have caused damage. The most widely known example of such an attack involved the Stuxnet worm which damaged centrifuges being used by Iran in its nuclear enrichment programme.
Benjamin Sonntag, a software developer and digital rights activist, told Reuters: "We do not expect a nuclear power plant or steel plant to be connected to the internet.
"To be computerised, but to be connected to the internet and to be hackable - that is quite unexpected," he said.

South Korea nuclear plant hit by hacker

Computers at a nuclear power plant in South Korea have been compromised by a hacker, but the plant's operator says no critical data has been leaked.
The hacker was able to access blueprints, floor maps and other information on the plant, the South Korean Yonhap News Agency reported Sunday. Using a Twitter account called "president of anti-nuclear reactor group," the hacker has released a total of four postings of the leaked data since December 15, each one revealing internal designs and manuals of the Gori-2 and Wolsong-1 nuclear reactors run by Korea Hydro and Nuclear Power Co. (KHNP), Yonhap added. The hacker has threatened to leak further information unless the reactors are shut down.
KHNP has insisted that the leaked information is not critical and does not undermine the safety of the reactors. The company also played down the threat of any type of cyberattack, saying that the reactors' controllers are protected because they're not linked to any external networks, according to the Wall Street Journal.
The hacking against KHNP nuclear plants occurs in the midst of a major hack against Sony Pictures over its movie "The Interview," a comedy about an assassination attempt against North Korean leader Kim Jong-un. The FBI has accused North Korea of orchestrating the Sony hack, though the country has denied any involvement. As a further response, North Korea suggested a joint investigation into the hack with the US but then accused the US of being involved in the making of the film, according to The Guardian.
Despite the increased tension, no fingers have been pointed at North Korea for the hacking against the KHNP power plants. An official at KHNP told Reuters that the hacking appeared to be the work of "elements who want to cause social unrest," but added that he had no one specific in mind.
Government officials looking into the incident were able to trace the hacker's IP address to a PC located in a specific location, Yonhap said. Investigators have been sent to the location as well as to the plant's reactors to probe further.

Senator: Backdoor for the Feds is a backdoor for hackers

Wyden pushes for law banning special access in software, hardware for cops and spies

A US Senator is urging Congress to pass laws forbidding Uncle Sam's spies from forcing software and hardware makers to build backdoors.
In an op-ed posted in the LA Times, Sen. Ron Wyden (D-OR) said that there was no safe way to build backdoors into phones, tablets, computers and software without exposing them to hackers to exploit.

Wyden, who this month proposed a bill to ban government agencies from mandating backdoors, noted the mechanisms US agencies want to use for law enforcement and intelligence will double as open invitations for foreign agencies and criminals to pwn devices.
"The problem with this logic is that building a back door into every cellphone, tablet, or laptop means deliberately creating weaknesses that hackers and foreign governments can exploit," Wyden wrote.
"Mandating back doors also removes the incentive for companies to develop more secure products at the time people need them most; if you're building a wall with a hole in it, how much are you going invest in locks and barbed wire?"
Mandatory backdoors in devices and code are a hot topic: g-men argue that being able to tunnel into devices is essential to saving lives by detecting and preventing crime. Privacy advocates, meanwhile, have argued that the tools are a violation of privacy and a major security threat.
Put Senator Wyden firmly in the latter category. He notes that even the government agencies themselves have proven less-than-trustworthy when it comes to handling data collected from citizen devices.
"For years, officials of intelligence agencies like the NSA, as well as the Department of Justice, made misleading and outright inaccurate statements to Congress about data surveillance programs — not once, but repeatedly for over a decade," he said.
"These agencies spied on huge numbers of law-abiding Americans, and their dragnet surveillance of Americans' data did not make our country safer."

Kenya breaks 'Chinese-run cyber crime network'

China has promised to help with investigations

Kenyan police say they have cracked a cyber crime centre run by 77 Chinese nationals from upmarket homes in the capital, Nairobi.

Police believe they were involved in hacking and money laundering. The group has been remanded in custody for five days to allow for further investigations.
The foreign ministry summoned a Chinese diplomat to discuss the arrests.
A Chinese official said the embassy was co-operating with investigations.
It was checking the passports of the suspects to see whether they were, in fact, Chinese nationals, the official told the BBC on condition of anonymity.
'Military-style dormitories' Police raids were triggered by a fire on Sunday at a home in Nairobi's Rhunda estate in which one person died.
"Preliminary findings show the fire was caused by one of the servers they were illegally operating," the director of Kenya's Criminal Investigations Department, Ndegwa Muhoro, told the privately owned Standard newspaper.
Numerous telephone headsets, computers linked to high-speed internet and monitors were found.
"The suspects are being interrogated to establish their mission in the country and what they wanted to do with the communication gadgets," Mr Muhoro is quoted by AFP news agency as saying.
The charges against the 77 so far include "being in the country illegally and operating radio equipment" without the necessary permits, AFP quotes an unnamed source as saying.
The suspects had been living in "military-style dormitories", and Chinese officials were shocked by the revelations, the Standard reports.
The group had been preparing to "raid the country's communication systems" and had equipment capable of infiltrating bank accounts, Kenya's M-Pesa mobile banking system and ATM machines, according to Kenya's privately owned Daily Nation newspaper.
Kenya's Foreign Minister Amina Mohamed summoned China's ambassador on Wednesday and "made it clear that the Chinese government should fully cooperate on this matter," Fred Matiang'i, the communications minister, said.
"China promised to send investigators to work with ours on this matter," he added.
The BBC's Paul Nabiswa in Nairobi says the raids come at a time when many Chinese companies are investing heavily in Kenya, especially in the construction industry.
The Kenyan government has signed many bilateral agreements with China and Chinese nationals have roles in government programmes, including in higher education institutions, he says.

Security for Everyone - Reviewing Kaspersky Internet Security 2015

Kaspersky has recently launched the 2015 version of their security products across North America and they will soon follow in Europe and other regions. While this version doesn't promise any spectacular new features, it does promise to provide many improvements over the 2014 edition. If you would like to learn more about what this new generation of products has to offer, read this review for Kaspersky Internet Security 2015.

First Impressions

In order to download Kaspersky Internet Security 2015, you have to first provide your email address. If you would like to skip this step, you can also directly download it from Softpedia.
You will download the full setup file which has 161MB. On top of that, the first major update of the suite will have at least 99 MB of files and it will only grow as time goes by. In total, expect to download at least 260 MB of files.
Before the installation starts, the setup searches for incompatible software and informs users when conflicts are found. This is a sensible approach that helps eliminate frustration with using Kaspersky. During the installation process you have to make only two clicks and you can't configure where the suite is installed or which modules are installed. However, any module can be easily disabled after the installation, if you don't plan to use it.

Once the installation is finished, the process for loading the security suite and enabling all its modules takes quite a bit of time. When done, its main user interface is shown, together with a message window that welcomes you to Kaspersky and informs you about this product's extra features. This window is shown each time you start the security suite unless you check the box that says "Do not show anymore".

No Windows restart is required and you can fully utilize Kaspersky Internet Security 2015 as soon as it is installed on your computer. However, its first automatic update starts after quite a bit of time and you might want to force a manual update as soon as the installation is finished.
Download and installing Kaspersky Internet Security 2015 is a an easy process that requires you to provide only an email address. The installation experience is very similar to that of previous versions which isn't a bad thing.

Integration with Windows 8.1 & Modern Apps

Kaspersky Internet Security 2015 is well integrated with Windows and all its security and networking features. When the suite is installed, it automatically disables the Windows Firewall and Windows Defender, so that it eliminates any possible conflicts and performance issues.
When it comes to integration with web-browsers, Kaspersky has a different approach from other vendors: it scans all your HTTP traffic so that you are protected in all browsers. They also offer a set of extensions that work only in Internet Explorer and Firefox: Content Blocker, Safe Money, URL Advisor and Virtual Keyboard. For Google Chrome they offer only the Virtual Keyboard and the URL Advisor while for Opera no extensions are offered.

When using this suite, I was able to access the network, share files and folders, stream media, play online games, etc. Updating modern Windows 8.1 apps also worked fine, without any manual configuration being performed. The only small integration issue we discovered is that Kaspersky Internet Security 2015 doesn't use smooth scaling icons for all its shortcuts. For some of its shortcuts still uses the same small ugly looking icons from the Windows XP era. But that's not impacting the security it provides in any way.

Kaspersky also offers Kaspersky Now - an optional app for Windows 8.1 that you can install from the Windows Store. This app keeps you updated with security news and information about Kasperky's products.

In terms of memory usage, this suite requires 87 MB of RAM, in normal conditions. When performing scans or when dealing with all kinds of attacks or malware infections, the memory usage goes up. Kaspersky does a good job at protecting its services and they cannot be terminated by users or malware. This suite is so well protected that, when using some of its features, you will have a hard time making screenshots. Screenshot taking tools like SnagIt will have a hard time taking screenshots of this suite.
Kaspersky Internet Security 2015 added only 1 second to our test system's boot time of 36 seconds. We also ran the PC Vantage and 3DMark Vantage benchmarks to see how much of an impact this suite has on performance. Both benchmarks did not reveal any meaningful performance difference after installing Kaspersky.
Kaspersky is well integrated with Windows 8.1 and its networking and security features. Also, it has a negligible impact on performance, which is great.

Ease of Use & Configuration

The user interface has been changed in the 2015 version. While we enjoyed the way things looked in the 2014 version, the new version has a rather weird looking interface. Yes, you can still find your way around this product and access everything you need, but our impression is that the new user interface takes a bit longer to get used to than that of the 2014 version.
As you can see, on the main screen you'll find a quick status update for this product and four big buttons that allow you to perform scans, make a product update, start Safe Money and Parental Controls.

If you press on "Show Additional Tools", you will have access to other tools that are included in this suite, as well as a few visual reports.

If you go to Settings you will first find a list with quick settings and switches for turning On and Off the different protection modules that are available. If you then select a protection module, you can change its more advanced settings. This is a good approach that works well for both novices and advanced users.

The only downside is that there is no Home button. As a result, you will end up pressing the Back button quite a lot and this might frustrate users when they go too deep in Kaspersky's configuration menus.
As always, Kaspersky offers lots of advanced configuration options. You can set complex rules for the firewall, choose the protection level you want for each module, add exclusions, configure the default scheduled scans or add your own custom scans. We very much enjoyed the fact that Kaspersky has scheduled scans for when your computer is sitting idle. Therefore, its regular quick scans and anti-rootkit scans won't bother users when they have work to do. We hope to see this approach emulated by other security vendors.
Help information is offered both in the form of local help files and online documentation. In terms of support, you can find all the available options directly in the suite. You can access online databases with tips and frequently asked questions, use the Kaspersky forums or use the built-in tools for gathering information about your device and reporting it to Kaspersky.

If you want access to more advanced support options, including support over the phone, you need to create a Kaspersky account and use it to report, track and solve your issues.
In terms of alerts, Kaspersky informs you when threats are detected and dealt with. You will see both anti-malware and firewall related prompts, only when appropriate.
When it comes to reports, Kaspersky offers both visual summaries on a daily, weekly or monthly basis, as well as detailed logs for all of its protection modules.

The user interface used by Kaspersky Internet Security 2015 is new but not necessarily better than that of the previous version. However, this product continues to work well and, after spending a bit of time learning where everything is placed, users should have no troubles in using this security product.

Firewall

The firewall protection module offered by Kaspersky has received some minor improvements versus the 2014 version. First of all, it actively monitors the wireless networks you are connecting to. If you have set a WiFi network as Public in Windows, Kaspersky automatically adjusts its firewall settings to protect you more effectively and it also warns you about the dangers of using public networks. If you click on the warning, you are taken to an article on Kaspersky's website that explains the risks involved when using untrusted public networks.

While this does improve the user's awareness about their security on public WiFi, this warning gets annoying relatively fast and many users will choose to disable this type of notification.
What's cool though is that now Kaspersky can be set to block and warn about insecure transmission of passwords over the Internet. However, this feature is not enabled by default. You can learn how to enable this setting later in this review.
Another improvement in the firewall module is that it actively monitors the network profile you assign in Windows and adjusts its settings accordingly. In the past it only checked the network profile you set for a network the first time you used it and kept the same settings forever. Now, if you change the network profile assigned in Windows multiple times, Kaspersky automatically adjusts its own settings as well, which is great.
The Kaspersky firewall is as customizable as always and you can set rules both at an application level and at a packet level.

To evalue how well Kaspersky does when blocking network attacks, we have performed several scans with Nessus. When our test network was set as Trusted, Nessus detected 15 open ports with a negligible impact on security and it was able to identify the MAC address, which doesn't represent a security risk.
When the network was set as Public, Nessus detected 10 open ports with a negligible impact on security and it was able to identify the MAC address. These are average results when compared to the firewall protection provided by other security suites.
Another aspect that's different about the Kaspersky firewall is that it informs users when it detects and blocks network attacks. We consider this a good thing as this makes users aware that they are not connected to a secure network and that someone is trying to attack their computer.

Kaspersky's firewall module does a decent job at protecting your computer from network threats. However, its effectiveness is not as great as some of its competitors.

Antivirus and Antispyware

Anti-malware protection is the area where Kaspersky traditionally does best and we were expecting good results again.
We started by browsing several malicious websites in all the main browsers. Kaspersky Internet Security 2015 was able to block everything in all the browsers, including in Opera, even though this browser doesn't have any extensions from Kaspersky.

Then, we plugged in a USB memory stick filled with malware samples. Kaspersky asked whether we would like it to scan this drive or not. After the scan was performed, it was able to identify and remove all malware samples.
We also installed Kaspersky on a Windows 8.1 installation which was pre-infected with malware. After its installation, this suite was able to detect and remove the malware found on the test system.
When dealing with nasty malware infections Kaspersky has a very thorough approach. It recommended that we restart the system in order to clean it up. Then, it launched the Microsoft Windows Troubleshooting wizard which checks for system problems that may have been caused by malware activity or the disinfection process. And, lastly, it also starts a full-system scan that double checks that there are no malware samples left on your computer.

Yes, this whole process is slower than that used by other security products but it is also a lot more thorough. The chances that some isolated malware sample will go unnoticed are much smaller.
In our testing we also measure how fast the scanning speed is. We asked Kaspersky Internet Security 2015 to scan a 38 GB partition with 26.4 GB of files and it took a long 48 minutes to finish. This was the first time that this partition was scanned. Subsequent scans were finished much faster, in only 8 minutes, which is close to what other security products have to offer. This difference in timings happens because, the first time Kaspersky scans a file, it also gathers data about it so that in subsequent scans it gets scanned only if its properties have changed since the first scan.
Since the 2015 version was launched only recently, other security organizations did not yet test it. We only have their results for the 2014 version:

• AV-TEST awarded Kaspersky a score of 6 out of 6 for protection, 6 for performance and 6 for usability.
• AV-Comparatives awarded Kaspersky their top Advanced+ rating in their latest round of testing.
• Virus Bulletin awarded Kaspersky their ultimate VB100 badge and measured a 90%+ reactive detection rate and an 70%+ proactive detection rate, which is the standard for good security products.

In terms of antimalware protection Kaspersky Internet Security 2015 remains a very effective product.

Other Features

Kaspersky Internet Security 2015 includes a large number of tools and additional features:

• Safe Money - when performing financial transactions online, Safe Money opens a protected browser window that continuously checks that your data is safe from prying eyes.
• Virtual Keyboard - an on-screen keyboard that should be used when you want to make sure that the data you enter is not logged by third-party apps or by malware.
• Anti-Banner - a module that removes ads when browsing the web. It offers browser extensions only for Internet Explorer and Firefox.
• Kaspersky Rescue Disk - this wizard is very easy to use and allows you to create a rescue disk with the latest version of Kaspersky, so that you can disinfect other computers that no longer work well.
• Parental Controls - this module allows you to set how much time your child uses the computer and when, specify the apps and games he is allowed to run, restrict internet access according to your rules, block or allow communication through instant messengers and block the transfer of private data (e.g. home address, credit card numbers) from your child to third parties.
• Privacy Cleaner - it clears your computer history of recent commands, accessed files, cookies, caches, logs, etc.
• Vulnerability Scan - this wizard scans Windows and third-party applications (like Flash or Java) for known vulnerabilities and it warns you when appropriate.
• Microsoft Windows Troubleshooting - this wizard checks for system problems that may have been caused by malware activity or the disinfection performed by the suite and tries to help you out when problems are found.
• Browser Configuration - this tool analyzes the configuration of Internet Explorer and it recommends improvements to its security settings.

Kaspersky Internet Security 2015 bundles several additional tools and features, some of which may prove useful to users.

Default Settings You Might Want to Improve

Kaspersky Internet Security 2015 is generally well configured but there are a few things that you might want to consider improving:

• Schedule a regular full system scan on a monthly basis. We like the fact that Kaspersky makes quick scans when your system is sitting idle, as well as regular rootkit scans. However, to be completely safe, it is best to run a full system scan once in a while.
• Go to "Settings -> Additional -> Threats and Exclusions" and you will find a setting named "Detect other software that can be used by criminals to damage your computer or personal data". Enabling this will make Kaspersky detect and report keyloggers and programs that are used for remote controlling your computer.
• Go to "Settings -> Protection Center -> Firewall" and you will find a setting that says "Block and warn about insecure transmission of passwords over the Internet". Enabling this setting is useful for laptop users who connect to lots of wireless networks. You never know when you don't pay enough attention and your passwords are sent over the Internet in an insecure manner.
• If you go to "Settings -> Additional -> Notifications" you may want to disable news notifications and unsubscribe yourself from receiving any marketing messages from Kaspersky.

Even though it's default configuration is good, there are a couple of minor settings that the user can improve about Kaspersky Internet Security 2015.

Verdict

Kaspersky Internet Security 2015 is a strong security product that has a lot to offer to its users. It continues to deliver some the best anti-malware protection on the market and its performance impact is mostly negligible on modern computers and devices. Also, Kaspersky remains as customizable as ever. Novices will very much enjoy the good default configuration it has to offer while advanced users will appreciate the fact that they can configure its functioning in detail. We definitely recommend it to all our readers.

Purchasing options

Kaspersky Internet Security 2015 can be purchased from Amazon US by North American readers. It wasn't yet launched in Europe but it will be made available very soon.

5 Tools to Password Protect Your Folders in Windows

LocK-A-FoLdeR - Free

LocK-A-FoLdeR is the perfect solution for absolute beginners. It uses only a single master password and it has a very minimal user interface. Also, it doesn't offer any settings that you can fiddle with.

After you have selected the folders that you want to protect, all you have to do is close the application.
Instead of using encryption, this program simply hides the folders from any user who might try to access them. To restore access to your protected folders you will have to reopen the program and use the unlock button.
A very good thing about LocK-A-FoLdeR is the fact that it doesn't need any services to run in order to keep your folders private. It is both easy to use and free.
Download link: LocK-A-FoLdeR.

Folder Guard - Commercial

This is one of the best programs we have tested in this roundup. It has a lot of features and all of them work well. You can protect files and folders using individual passwords or you can choose to simply lock and hide them. The interface looks good, it is well structured and easy to use. You can drag and drop the folders that you want to protect or you can use the tree view to select them. A really nice feature is that it allows you to create filters for different kinds of files so that they will be automatically protected. Also, you can choose to selectively assign access permissions for the user accounts that are registered on your computer.

This program has a trial version that works for 30 days. The full version costs $39.95 and it gives users the possibility to upgrade to any new version during the first year of use. Also, it can be used on 2 computers. After the first year, if you want to upgrade to newer versions, you have to pay for a new license.
Download link: Folder Guard.

Folder Protector - Free & Commercial

This program uses encryption to protect your folders. All you have to do is launch it, select the folder you want to lock, enter a password twice and press Protect. The folder is encrypted and all you'll find inside is a small executable that you can use to unlock that folder. You can also use the program itself to unlock the folders that you protected.

To get a complete understanding of how it works, read this tutorial provided by the company that has developed it: Password Protect Folders with Folder Protector.
This program works for free with very few limitations. You can set it to use 256-bit encryption only if you purchase the Pro version which costs $24.95.

Download link: Kakasoft Folder Protector.

Folder Lock Lite - Commercial

Folder Lock Lite is a well structured program that lets you protect your folders, files and even entire drives. When you run this program for the first time, it asks you to enter a master password. This password is used for every folder and file you choose to lock. Then, you can simply drag and drop the items you want protected, onto the main interface. All the folders you chose to protect are immediately locked and they are also hidden. Nobody will get access to them unless they know the master password you have set.

The trial version allows you to use this program for 30 days. If you will want to continue using it after that, you'll have to pay $24.95.
Download link: Folder Lock Lite.

Protected Folder - Commercial Tool

This program is easy to use and has a nice and clean user interface. It uses a single master password for all the folders that you choose to protect.
To add the folders that you want protected, use the Add button and then select them. You can also drag and drop those folders into this program's user interface.

Protected Folder offers several customization options, including how you want it to deny access to your protected folders for the users that do not have the master password.

Another thing worth mentioning is that you cannot uninstall this program without first providing the master password. After it is uninstalled, all your locked folders are automatically unlocked, thus eliminating the risk of losing your data.
You can start and use this program for free, 20 times without any limitations. After that, if you want to keep using it, you have to pay $19.95/year.
Download link: Protected Folder.

Sony hacking reveals bosses wanted to pay Jennifer Lawrence less than American Hustle male co-stars

Revelation comes days after rants about Angelina Jolie and Michael Fassbender were leaked to press

Sony Pictures bosses are facing yet more embarrassment after hackers revealed Oscar-winning actress Jennifer Lawrence was paid less than her male co-stars in American Hustle.

More leaked emails show Lawrence was paid less than her male co-stars, including Christian Bale, Bradley Cooper and Jeremy Renner, despite Lawrence's ever-growing profile and popularity, The Daily Beast reports.
According to the Beast, an email dated 5 December sent to Sony co-chair Amy Pascal from Andrew Gumpert, president of business affairs and administration for Columbia Pictures, read: “Got a steve warren/gretchen rush call that it’s unfair the male actors get 9% in the pool and jennifer is only at 7pts.” Warren and Gretchen are understood to be Lawrence’s legal representatives.
The email continued: “You may recall Jennifer was at 5 (amy was and is at 7) and WE anted in 2 extra points for Jennifer to get her up to 7. If anyone needs to top jennifer up it’s megan. BUT I think amy and Jennifer are tied so upping JL, ups AA.”
The AA referred to in this email is Amy Adams and Megan is reported to be Megan Ellison, head of Annapurna Pictures, which co-financed American Hustle. Adams is a five-time Oscar-nominated actress.
The final percentage the actors were paid is unknown.
 
Jennifer Lawrence as Rosalyn Rosenfeld in a scene from "American Hustle" Gumpert added, “The current talent deals are: O’Russell: 9%; Cooper: 9%; Bale: 9%; [Jeremy] Renner: 9%; Lawrence: 7%; Adams: 7%.”
Pascal responded to the email discussing the pay disparity between Lawrence and her co-stars with: “there is truth here.”
Previous leaked emails between Pascal and film producer Scott Rudin saw Angelina Jolie branded a 'minimally talented spoiled brat' and Michael Fassbender discussed in a dismissive manner in others.

Jennifer Lawrence on screen

Pascal and Rudin also found themselves facing more serious accusations of racism when cyber hackers leaked email conversations suggesting President Barack Obama would prefer films with African-American leads or themes.
The private emails were leaked after Sony was targeted by hackers identified in US media as Guardians of Democracy who released a trove of internal company data and emails.

Pascal released a statement on Thursday apologising for the content of the emails. “The content of my emails were insensitive and inappropriate but are not an accurate reflection of who I am,” she said. “Although this was a private communication that was stolen, I accept full responsibility for what I wrote and apologise to everyone who was offended.”
Rudin, who produced The Social Network and Captain Phillips among others, has also publicly apologised. “Private emails between friends and colleagues written in haste and without much thought or sensitivity, even when the content of them is meant to be in jest, can result in offense where none was intended,” he told Deadline.
“I made a series of remarks that were meant only to be funny, but in the cold light of day, they are in fact thoughtless and insensitive — and not funny at all. To anybody I’ve offended, I’m profoundly and deeply sorry, and I regret and apologise for any injury they might have caused.”
Sony Pictures did not immediately respond to a request for comment.

Hacked Sony reportedly shuts production

Dec. 2, 2014: Sony Pictures Entertainment headquarters in Culver City, Calif. (AP)

Sony Pictures has abandoned film shoots because hackers have crippled its computer network, The Times of London reported Saturday.
The Times, quoting “a source,” said agencies filming for Sony had cancelled shoots because the hacking had left it unable to process payments.
Sony did not immediately reply to a request for comment.
A hacking collective itself the Guardians of Peace began the attack on Sony late last month, leaking four films and thousands of documents and wreaking havoc on the studio’s network, along with a huge dose of embarrassment.
Emails between top producers and executives belittling a number of major stars and projects, and even making racist jokes about President Barack Obama were leaked earlier this week.
In one email exchange, Sony co-chairperson Amy Pascal -- a prominent Democratic party donor and Obama supporter -- asked movie producer Scott Rudin ahead of a fundraiser what she should ask the President "at this stupid Jeffrey (Katzenberg) breakfast," to which Rudin quipped "would he like to finance some movies."
"I doubt it. Should I ask him if he liked DJANGO?" Pascal responded, Rudin then retorted: "12 Years."
In other exchanges between Pascal and Rudin, Angelina Jolie was called a “spoiled brat,” and unflattering comments were made about everyone from Tom Cruise to David Fincher, Aaron Sorkin and Adam Sandler.
The Jolie diss served as particular embarrassment for the company, with one source noting that Sony "is like a pariah" to A-list talent now.
The FBI has launched a probe into the attack. The agency also sent out an “FBI alert” to companies in the entertainment sector, describing the characteristics of the so-called “wiper malware” used in the attack.
The finger of suspicion has already pointed at North Korea. A source familiar with the FBI alert told Fox News that the highly destructive malware was written in Korean, further fueling suspicions that Pyongyang launched the cyber attack in retaliation for a Sony film, "The Interview," which parodies its leader, Kim Jong Un.

Government: 'We want more people to develop cyber security skills'

The government wants to nurture cyber security skills in the UK and aims to encourage more people into the sector, Minister for the Cabinet Office Francis Maude MP has said.
Maude made the comments at an event to highlight cyber skills that marked the third anniversary of the UK's Cyber Security Strategy. During the speech at the Institute for Chartered Accountants of England and Wales (ICAEW), Maude also announced measures to encourage people to acquire cyber security skills.

Further reading

These include grants for colleges and universities in Birmingham, Liverpool, London and Newcastle to improve cyber security education and learning, with sponsorship from private firms including Barclays Bank.
The government is also releasing a student-designed app to highlight what skills a career in cyber security requires.
"As part of this government's long-term economic plan we want to ensure that Britain is one of the safest places to do business online," said Maude.
"Over the past three years we have taken a strategic approach to improving cyber security, working with others to deliver schools programmes, certified six Masters degrees, two centres for doctoral training and 11 Academic Centres of Excellence," he continued.
Maude then referenced World War II codebreaker Alun Turing, who was recently honoured with the announcement that a London-based big data institute will be named after him.
"With Alan Turing and Bletchley Park, the UK has a proud heritage in cryptography and computer science," said Maude.
"40,000 people work in our cyber industry and we have 14 cyber security ‘clusters' across the country. But we want to develop greater skills and encourage more people to pursue a career in this growth area."
Maude went on to talk about government policy designed to promote careers in cyber security.
"Today we are releasing the Cryptoy app, designed by students at GCHQ. We hope it will spark a new interest for a career in cyber security," he said. "Our new cyber camps, mentors and higher education academy grants will help more towards a cyber security career."
Stephanie Daman, CEO of the Cyber Security Challenge UK, welcomed the announcements by Maude.
"Today's announcement highlights the government's ongoing commitment to improving the size and quality of the UK's cyber security talent pool," she said.
"It also demonstrates a real understanding that addressing our cyber security skills gap requires a sustained programme of targeted support for innovative programmes and initiatives that are inspiring the next generation of cyber professionals," Daman added.
Maude has often commented on cyber security. Earlier this year he described how 'the internet is too large for any organisation to fight cyber crime alone'.

Telangana government mulls cyber security programme under TASK

INDIA - HYDERABAD: The Telangana government is planning to launch a specialized cyber security programme in association with the state's technology institutes under its Telangana Academy of Skill and Knowledge (TASK) initiative, said a top Telangana official on Friday.

"According to Union government estimates, the country requires around 5 lakh cyber security professionals. We think this is a great opportunity for us to create jobs by imparting training in this area. Hence, we are actively looking at launching a cyber security programme under TASK and are in talks with institutions such as IIIT to chalk out the framework," Telangana IT, Electronics & Communications department director (communications) A S Ramesh said during a session on 'e-governance' organized by the Computer Society of India (CSI) as part of its golden jubilee program - CSI 2014 -- here. However, he did not specify the timeline for the launch of the programme.

Even Telangana chief secretary Rajiv Sharma pointed out that data security was a major concern for the state government due to the rise in instances of cybercrimes in the country.

Meanwhile, Ramesh also pointed out that the government has requested that Union government to extend its National Optical Fibre Network (NOFN) project to all districts of Telangana. Currently, the network is restricted to Nizamabad, Khammam and Rangareddy.

Under the NOFN initiative, the Union government will lay 7-lakh-km of optical fibre cable in all the major village panchayats of the country.

Speaking about e-government initiatives of the Union and state governments, PWC managing consultant Biju Kadapurath said that apart from connecting to citizens digitally, governments can also look at G-2-G (government to government) as well as G-2-E (government to employee) communication.

Indian School of Business (ISB) dean Ajit Rangnekar pointed out that if the government wants to bring more people under its e-governance umbrella, it must look at providing services on mobile platforms as well because most of the people in the rural India access internet via mobiles. This apart, he said that it was necessary to provide these services in local languages as it would enable more people to use e-governance services in the country.

Sony Pictures Knew of Gaps in Computer Network Before Hack Attack

 

A security audit of Sony Pictures Entertainment’s computer network conducted just months before hackers unveiled a devastating cyberattack against the company showed gaps in the way the company monitored its systems.

The audit, performed by PricewaterhouseCoopers, found one firewall and more than 100 other devices that were not being monitored by the corporate security team charged with oversight of infrastructure, but rather by the studio’s in-house group, which was tracking activity on logs.
This raised a red flag for the auditors, who said it could slow Sony’s response to a problem.
“Security incidents impacting these network or infrastructure devices may not be detected or resolved timely,” warns PriceWaterhouseCoopers, which conducted the audit from July 14 to Aug. 1.
The confidential report, dated Sept. 25, was among Sony Pictures General Counsel Leah Weil’s email correspondence, which hackers released to public file-sharing networks earlier this week. It included recommendations for bolstering security.
The report, obtained by Re/code, was independently verified by a person familiar with the matter.
The revelation that the studio knew of its network vulnerabilities comes as Sony struggles to recover from a crippling attack on Nov. 24 that resulted in the public disclosure of scores of personal emails, budgets, salary information and other previously private documents. In all, a hacker group calling itself Guardians of Peace claimed to have stolen under 100 terabytes of data.
Sony Pictures told law enforcement it is worried the studio might fall victim to another round of cyberattacks after it releases the film “The Interview” on Dec. 25, Reuters reported. Re/code first reported on Nov. 28 the studio explored the possibility that North Korea was behind the attack.
Investigators are evaluating whether the attack on the studio was in retaliation for the film, a comedy starring Seth Rogen and James Franco about a CIA-backed assassination attempt on North Korean leader Kim Jong-Un.
 Months before the Guardians of Peace announced its attack on studio, auditors had been asked to evaluate unspecified security incidents at Sony Pictures, according to the audit. The investigation focused on inner workings of computer security procedures such as incident notifications and tracking, essentially keeping track of problems that might indicate a security breach is underway.
Auditors found that since transitioning from a third-party vendor in September 2013, Sony Pictures had failed to notify the corporate security team to monitor newly added devices, such as web servers and routers.
Studio management told the auditors its corporate security team is focused on bolstering devices on the perimeter of Sony’s networks and that it hasn’t applied “the same level of rigor” for other, non-security devices such as routers and web servers. The document doesn’t go into detail as to why a different standard was applied.
By the end of July, Sony Pictures provided a current inventory of all devices to be tracked.
Auditors also found that Sony Pictures failed to reconcile the list of security devices its corporate team should have been monitoring with those it was monitoring. As a result, they might have missed additional devices being added to or removed from the networking, adding that “critical security devices may not be monitored.”
Sony Pictures’ in-house staff pledged to develop a process for keeping track of its devices by Oct. 31 — barely a month before hackers made their presence on the studio’s corporate network known.
A spokesperson for the studio declined to comment on the audit report. A PwC auditor who received the report did not respond to interview requests.

AliExpress WebSite Vulnerability Exposes Millions of Users’ Private Information

AliExpress is an online marketplace owned by Chinese E-Commerce giant Alibaba.com, which offers more than 300 Million active users from more than 200 countries and regions to order items in bulk or one at a time at low wholesale prices.

BarakTawily, an Israeli application security researcher working at AppSec Labs, reported the vulnerability to The Hacker News after providing full disclosure of the flaw to the AliExpress team and Israeli media.

According to the Proof-of-Concept video and screenshots provided by the security researcher to The Hacker News, AliExpress website allows logged in user to add/update their shipping address and contact number at the following URL i.e.

http://trade.aliexpress.com/mailingaddress/mailingAddress.htm?mailingAddressId=123456

Where “123456” is the user id of the logged in user. Researcher noticed that just by changing value of “mailingAddressId” parameter to a different value, one could easily exploit the validation flaw of the website to display the Mailing Address and contact information of the respective user on the same webpage, as shown.

A Smart attacker can simply gather personal information of millions of AliExpress users just by using an automated script to crawl “mailingAddress.htm” page for all possible numbers between 1 to 99999999999 as “mailingAddressId” parameter value.

The vulnerability has been reported to AliExpress team and will soon be patched in coming hours, researcher indicated.

‘Security by Antiquity’ Bricks Payment Terminals

Last week, several thousand credit card payment terminals at various retailers across the country suddenly stopped working, their LCD displays showing blank screens instead of numbers and letters. Puzzled merchants began to worry that this was perhaps part of some sophisticated hacker attack on their cash registers. It turns out that the incident was indeed security-related, but for once it had nothing to do with cyber thieves.

Hypercom L4250 payment terminal.

On Dec. 7, 2014, certain older model payment terminals made by Hypercom stopped working due to the expiration of a cryptographic certificate used in the devices, according to Scottsdale, Ariz.-based Equinox Payments, the company that owns the Hypercom brand.
“The security mechanism was triggered by the rollover of the date and not by any attack on or breach of the terminal,” said Stuart Taylor, vice president of payment solutions at Equinox. “The certificate was created in 2004 with a 10 year expiry date.”
Taylor said Equinox is now working with customers, distributors and channel partners to replace the certificate to return terminals to an operational state. The company is pointing affected customers who still need assistance to this certificate expiry help page.
“Many of these terminals have been successfully updated in the field,” Taylor said. “Unfortunately, a subset of them can’t be fixed in the field which means they’ll need to be sent to our repair facility.  We are working with our customers and distribution partners to track down where these terminals are and will provide whatever assistance we can to minimize any disruption as a result of this matter.”
According to two different merchants impacted by the incident that reached out to KrebsOnSecurity, the bricking of these payment terminals occurs only after the affected devices (in the 4x version of the terminals) are power-cycled or rebooted, which some merchants do daily.
Michael Rochette, vice president at Spencer Technologies, a Northborough, Mass.-based technology installation and support company, said his firm heard last week from an East Coast supermarket chain that opened for business on Monday morning only to find all of their payment terminals unresponsive. Rochette said that the supermarket chain and other retailers impacted by the incident across the country were immediately worried that the incident was part of a hacker attack on their payment infrastructure.
“Not all stores power cycle overnight, but for those that do, they came up all blank and inoperative,” Rochette said. “If that’s something that a retail chain does as a matter of policy across a whole chain of stores, that can be pretty damaging.”
One retailer that contacted KrebsOnSecurity but asked to remain anonymous said technicians at its locations had spent three days trying without success to restore the devices.
“I use two different generations of their terminals and have spent the last three days trying to understand completely why I had zero impact,” a reader from the retailer said. “Mass extinction of my POS devices at the manufacturer level was never on my list of scenarios that would wreck my day at retail.  It is now.”
While designing your products so that they fail after 10 years seems like a less than brilliant idea, this incident is a reminder of just how much of the payments infrastructure in the United States relies on rapidly aging technology.
According to Rochette, at least one of the affected Hypercom devices is no longer allowed to be used in retail installations after 2014, per sunset provisions set out by the PCI Council, an industry group that sets security standards for payment systems. Other Hypercom models affected by this incident are perfectly acceptable to use for years to come.
As for why Equinox failed to warn its customers of the impending meltdown of these payment terminals? Rochette posits that it might have something to do with Hypercom’s rocky corporate history.
“I’ve never seen this before where a particular product all crashed on the same day, and as far as I can tell there was no advance warning about this from Equinox,” Rochette said. “Over the last few years, they were Hypercom, then part of Equinox, then part of Verifone for a while, so I suspect there’s been a lot of turnover in personnel there, and frankly they just lost sight of the fact that they had a pretty important expiration date coming.”

Steam Holiday Auction Shuts Down After Gem Exploits Spread

Shortly after launching its "Holiday Auction" on Steam last night, Valve was forced to put the thing on an indefinite hold—suspending many PC gamers wish to reap a bounty of free games. The problem? "There have been some issues with Gems." Dammit, Gems!12

For those unfamiliar, the Holiday Auction is a new and exciting-sounding event that Valve kicked off this year inviting PC gamers to compete in a large-scale raffle staged by Steam. This year, Valve promised to give out 100 copies of almost 2,000 games. And the best part? You don't need real-world, paper money to participate in the auction. At least, directly. Rather, participants used the "Gems," a virtual currency that can be acquired by trading in Steam community items: trading cards, custom backgrounds, game-specific virtual swag, stuff like that.

If you are familiar with PC gaming, you can probably tell where this is going. Shortly after Steam users were allowed to start placing their first bids, posts popped up on the service's subreddit identifying issues with the gems and highlighting potential exploits. Player reports vary depending on people's personal experience, but many have said that their gems have simply disappeared from their Steam inventory. A rough consensus has emerged, meanwhile, which concludes that the Holiday Auction has officially been derailed by numerous duplication exploits—i.e., certain participants figuring out how to artificially inflate their gem count, and thus increase their chances of winning the games that are being given out next week.

Needless to say, some Steam users are upset with the news. And they're particularly upset with the alleged gamers who are taking advantage of the exploit for "ruining [the] fun for everyone," as one person put it on Reddit. It's not entirely clear if duplications or other exploits are actually the problem here, however.3

Expand

All Valve has said so far is: "Sorry, but there have been some issues with Gems and the Steam Holiday Auction has been temporarily closed," in a notice on the FAQ page for the holiday auction. "The elves are working frantically to get the issues sorted out, and the auction will start again as soon as they're done."

According to the FAQ page, the actual auctions take place from December 15th through the 18th. Whether the event will still go according to plan remains an open question, however, since the service is still down.

We've reached out to Valve for comment, and will let you know when we have more information.

UPDATE (1:45 pm): Valve got back to us saying they've updated the holiday auction page. It now says: "We had an issue with Gems that means we need to reset and start again." Valve said that players will have their Gems returned to them, and be reimbursed for any "Gem purchases from the community market." Bids have been canceled since the auction is being reset, and "trades involving Gems are being investigated on a case-by-case basis."

Expand

We'll have more on this story as it continues to develop.

UPDATE 2 (5:45 pm): And it's back! The auction has been up and running again for the afternoon, so you're free to go in and participate in the Gem trading once again. Proceed with caution, as always. Happy holidays!

Server failure clears skies over London as flights are grounded

Flights are now departing again from London airports after airspace over London was closed this afternoon due to a computer failure.
The problem was reported by Eurocontrol just after 3pm London time.

A computer failure is affecting London airspace with potentially severe #flightdelay

At the time of writing, NATS, the organisation that provides the air traffic control service over the UK capital, was reporting that airspace capacity was restricted, although they weren't saying how restricted, or why.

NATS can confirm that a technical problem has been reported at Swanwick air traffic control centre.
UK airspace has not been closed, but airspace capacity has been restricted in order to manage the situation. We apologise for any delays and our incident response team has been mobilised.
Every possible action is being taken to assist in resolving the situation and to confirm the details.
Further information will be released as it becomes available.

The BBC is reporting that the outage was caused by "a failure of the flight data computer server", whilst El Reg quotes a Heathrow spokesman describing it as "a power outage at the NATS control centre in Swanwick".
The UK capital is home to several airports including one of the world's busiest, London Heathrow, which acts a major international hub and dispatches new flights every 90 seconds.
Flights were suspended as far north as Leeds Bradford Airport and as far south as Southampton.
Passengers were left stranded as incoming and outgoing journeys were stopped and Londoners, who exist beneath an almost perpetual queue of stacking jets, found themselves under clear skies.
AirLive.net's real time flight maps gave just a hint of what was up.

Congratulations are due to the pilots and air traffic controllers who managed the situation and got everyone either safely grounded or shepherded out of London airspace.
Facts are thin on the ground but so far there's no hint of foul play in the server failure.
Nevertheless the outage is a timely reminder: computers are just machines and all machines fail eventually. We may not be able to prevent the failure or stop the power going out but we can control how ready we are for when it happens.

Audit shows University of Maryland security flaws remain

It's been almost a year since a huge data breach exposed the Social Security numbers of students, staff and faculty, both present and former at the University of Maryland College Park (UMCP), but a state audit has revealed that flaws in the university's network security, many identified by an audit five years ago, still exist.
In a letter accompanying the audit report of the university's Division of Information Technology, Thomas J. Barnickel III, an auditor in Maryland's Office of Legislative Audits, said the school's main campus in College Park, Md., had not used firewalls to secure all “network segments from the Internet and untrusted portions of its internal network.”
And in some instances where firewalls were used they “allowed insecure and unnecessary connections to critical data center to critical data center computer resources,” Barnickel wrote. The intrusion system, too, hadn't been configured to monitor traffic from all untrusted stories.
Like many organizations, UMCP hadn't kept current on updates to its anti-malware software. The audit found the IT department, which had an approximately $50 million budget and a force of 419 fulltime and contract employees in fiscal 2014, “didn't ensure anti-malware software was installed, up-to-date, and operating properly” on the computers it operates.
While the state was conducting its audit, UMCP experienced a massive breach to its identity card database. The audit report noted that the attack compromised “multiple computer resources hosted or maintained” by the IT department, and took “advantage of certain security weaknesses” such as  publicly accessible website and server, the system that hosted IT department employee credentials, critical application source code associated with the ID card database as well as the database's userid and password.
UMCP's Cybersecurity Task Force had made 18 recommendations for the university in June, two months after a second breach, among them, minimizing the number of systems that contain confidential information, isolating that information, conducting period penetration testing and creating an IT security advisory committee.
While the audit report noted that UMCP and the task force had apparently taken appropriate steps to assess and mitigate risks associated with confidential data retention and transmission “due to the focus of the Task Force being primarily the security over confidential data, those actions may not fully address” the audit report's findings.

Hackable intercom lets you SPY on fellow apartment-dwellers

Kiwicon Kiwi hacker Caleb "alhazred" Anderson has popped a video intercom device that could have allowed him to spy on the 700 apartments in his building. The GrandStream GXV3175 intercom unit has been patched after Anderson - who by day serves as Context Information Security's lead consultant - began the attack while "inspired" by a hangover.

Caleb Anderson. By Darren Pauli

"I thought one day 'I bet I can hack that (the GXV3175) and get a feed into every one of the 700 apartments in my building'," Anderson told the Kiwicon hacker confab in Wellington today.
"The unit looks exactly normal, you can't see that it's hacked by looking at it."
Anderson found directory traversal and command injection flaws that, among other bugs, granted access to intercoms.
Anderson did not access any of the units in his apartment and merely demonstrated that the feat was possible.