Skip to main content

Home/ Indie Nation/ Group items tagged x

Rss Feed Group items tagged

John Lemke

Shellshock: Code injection vulnerability found in Bash | LIVE HACKING - 0 views

  • A code injection vulnerability in the Bourne again shell (Bash) has been disclosed on the internet. If exploited then arbitrary commands can be executed, and where Bash is used in relation to a network service, for example in CGI scripts on a web server, then the vulnerability will allow remote code execution.
  • The problem is that Bash does not stop after processing the function definition; it continues to parse and execute any shell commands following the function definition
  • The vulnerability is deemed as critical because Bash is used widely on many types of UNIX-like operating systems including Linux, BSD, and Mac OS X.
  • ...1 more annotation...
  • The most prominent attack vector is via HTTP requests sent to CGI scripts executed by Bash. Also, if SSH has been configured to allow remote users to run a set of restricted commands, like rsync or git, this bug means that an attacker can use SSH to execute any command and not just the restricted command.
John Lemke

Hackers Using 'Shellshock' Bash Vulnerability to Launch Botnet Attacks - 0 views

  • Researchers on Thursday discovered a critical remotely exploitable vulnerability in the widely used command-line shell GNU Bourne Again Shell (Bash), dubbed "Shellshock" which affects most of the Linux distributions and servers worldwide, and may already have been exploited in the wild to take over Web servers as part of a botnet that is currently trying to infect other servers as well.
  • the vulnerability is already being used maliciously by the hackers.
  • There is as of yet no official patch that completely addresses both vulnerabilities, including the second, which allows an attacker to overwrite files on the targeted system.
  • ...3 more annotations...
  • It's things like CGI scripts that are vulnerable, deep within a website (like CPanel's /cgi-sys/defaultwebpage.cgi)," Graham wrote in a blog post. "Getting just the root page is the thing least likely to be vulnerable. Spidering the site and testing well-known CGI scripts (like the CPanel one) would give a lot more results—at least 10x." In addition, Graham said, "this thing is clearly wormable and can easily worm past firewalls and infect lots of systems. One key question is whether Mac OS X and iPhone DHCP service is vulnerable—once the worm gets behind a firewall and runs a hostile DHCP server, that would be 'game over' for large networks."
  • 32 ORACLE PRODUCTS VULNERABLE
  • PATCH ISSUED, BUT INCOMPLETE
  •  
    "Researchers on Thursday discovered a critical remotely exploitable vulnerability in the widely used command-line shell GNU Bourne Again Shell (Bash), dubbed "Shellshock" which affects most of the Linux distributions and servers worldwide, and may already have been exploited in the wild to take over Web servers as part of a botnet that is currently trying to infect other servers as well."
John Lemke

Scientists May Have Decoded One of the Secrets to Superconductors | Science | WIRED - 0 views

  • “In the same way that a laser is a hell of a lot more powerful than a light bulb, room-temperature superconductivity would completely change how you transport electricity and enable new ways of using electricity,” said Louis Taillefer, a professor of physics at the University of Sherbrooke in Quebec.
  • ripples of electrons inside the superconductors that are called charge density waves. The fine-grained structure of the waves, reported in two new papers by independent groups of researchers, suggests that they may be driven by the same force as superconductivity. Davis and his colleagues directly visualized the waves in a study posted online in April, corroborating indirect evidence reported in February by a team led by Riccardo Comin, a postdoctoral fellow at the University of Toronto.
  • Taken together, the various findings are at last starting to build a comprehensive picture of the physics behind high-temperature superconductivity. “This is the first time I feel like we’re making real progress,” said Andrea Damascelli, a professor of physics at the University of British Columbia who led two recent studies on charge density waves. “A lot of different observations which have been made over decades did not make sense with each other, and now they do.”
  • ...4 more annotations...
  • The community remained divided until 2012, when two groups using a technique called resonant X-ray scattering managed to detect charge density waves deep inside cuprates, cementing the importance of the waves. As the groups published their findings in Science and Nature Physics, two new collaborations formed, one led by Damascelli and the other by Ali Yazdani of Princeton University, with plans to characterize the waves even more thoroughly. Finishing in a dead heat, the rival groups’ independent studies appeared together in Science in January 2014. They confirmed that charge density waves are a ubiquitous phenomenon in cuprates and that they strenuously oppose superconductivity, prevailing as the temperature rises.
  • y applying Sachdev’s algorithm to a new round of data, Davis and his group mapped out the structure of the charge density waves, showing that the d-wave distribution of electrons was, indeed, their source.
  • The waves’ structure is particularly suggestive, researchers say, because superconducting pairs of electrons also have a d-wave configuration. It’s as if both arrangements of electrons were cast from the same mold. “Until a few months ago my thought was, OK, you have charge density waves, who cares? What’s the relevance to the high-temperature superconductivity?” Damascelli said. “This tells me these phenomena feed off the same interaction.”
  • In short, antiferromagnetism could generate the d-wave patterns of both superconductivity and its rival, charge density waves.
John Lemke

Scientists create the first life form with 'alien' DNA | The Verge - 0 views

  • genetic code comprises six letters, instead of four
  • the bacteria appear to be reproducing normally and passing on the new X-Y pair to their offspring.
  • t probably wouldn't survive for very long, Romesberg said, because it needs to feed on synthetic molecules to replicate — molecules that only the scientists can supply.
John Lemke

New Zealand Launched Mass Surveillance Project While Publicly Denying It - The Intercept - 0 views

  • Documents provided by NSA whistleblower Edward Snowden show that the government worked in secret to exploit a new internet surveillance law enacted in the wake of revelations of illegal domestic spying to initiate a new metadata collection program that appeared designed to collect information about the communications of New Zealanders.
  • Those actions are in direct conflict with the assurances given to the public by Prime Minister John Key (pictured above), who said the law was merely designed to fix “an ambiguous legal framework” by expressly allowing the agency to do what it had done for years, that it “isn’t and will never be wholesale spying on New Zealanders,” and the law “isn’t a revolution in the way New Zealand conducts its intelligence operations.”
  • Snowden explained that “at the NSA, I routinely came across the communications of New Zealanders in my work with a mass surveillance tool we share with GCSB, called ‘X KEYSCORE.”" He further detailed that “the GCSB provides mass surveillance data into XKEYSCORE. They also provide access to the communications of millions of New Zealanders to the NSA at facilities such as the GCSB facility in Waihopai, and the Prime Minister is personally aware of this fact.”
  • ...4 more annotations...
  • Top secret documents provided by the whistleblower demonstrate that the GCSB, with ongoing NSA cooperation, implemented Phase I of the mass surveillance program code-named “Speargun” at some point in 2012
  • Over the weekend, in anticipation of this report, Key admitted for the first time that the GCSB did plan a program of mass surveillance aimed at his own citizens, but claimed that he ultimately rejected the program before implementation. Yesterday, after The Intercept sought comment from the NSA, the Prime Minister told reporters in Auckland that this reporting was referring merely to “a proposed widespread cyber protection programme that never got off the ground.” He vowed to declassify documents confirming his decision.
  • That legislation arose after it was revealed in 2012 that the GCSB illegally surveilled the communications of Megaupload founder Kim Dotcom, a legal resident of New Zealand. New Zealand law at the time forbade the GCSB from using its surveillance apparatus against citizens or legal residents. That illegal GCSB surveillance of Dotcom was followed by a massive military-style police raid by New Zealand authorities on his home in connection with Dotcom’s criminal prosecution in the United States for copyright violations. A subsequent government investigation found that the GCSB not only illegally spied on Dotcom but also dozens of other citizens and legal residents. The deputy director of GCSB resigned. The government’s response to these revelations was to refuse to prosecute those who ordered the illegal spying and, instead, to propose a new law that would allow domestic electronic surveillance.
    • John Lemke
       
      The Dotcom raid was ruled illegal.  Yet the Dotcom spying was exactly the type of activity of this plan.
  • n high-level discussions between the Key government and the NSA, the new law was clearly viewed as the crucial means to empower the GCSB to engage in metadata surveillance. On more than one occasion, the NSA noted internally that Project Speargun, in the process of being implemented, could not and would not be completed until the new law was enacted.
John Lemke

Japan may send chatty humanoid tweet-bot to space - Yahoo! Finance - 0 views

  •  
    Japan's space agency is considering putting a talking humanoid robot on the International Space Station to watch the mission while astronauts are asleep, monitor their health and stress levels and communicate to Earth through the microblogging site Twitter. Japan's space agency JAXA announced this week that it is looking at a plan to send a humanoid robot to the space station in 2013 that could communicate with the ground through Twitter -- primarily feeding photos, rather than original ideas -- and provide astronauts with "comfort and companionship."
1 - 9 of 9
Showing 20 items per page