- apple-list - University of Manitoba Mailing Lists

INTEREST: SONY: security analysts talk about recent security breaches
by Wayne Billing 09 Dec '14

09 Dec '14

...from: http://arstechnica.com/security/2014/12/unprecedented-cyberattack-no-excuse… “Unprecedented” cyberattack no excuse for Sony breach, pros say If the security industry can’t save you, it will apologize for you. by Robert Lemos<http://arstechnica.com/author/roblemos/> - Dec 9 2014, 4:30pm CST * Share<https://www.facebook.com/sharer.php?u=http%3A%2F%2Farstechnica.com%2Fsecuri…> * Tweet<https://twitter.com/share?text=%E2%80%9CUnprecedented%E2%80%9D+cyberattack+…> 1<http://arstechnica.com/security/2014/12/unprecedented-cyberattack-no-excuse…> The security company investigating the attack against Sony Pictures Entertainment has reportedly penned a letter that seemingly holds the entertainment firm blameless for the breach of its systems—a move that has opened up the investigating firm to criticism by security professionals. The letter—to SPE’s CEO Michael Lynton from Kevin Mandia, the head of FireEye’s Mandiant, the incident response service the company hired to investigate the attack and restore its network—calls the attack “unprecedented in nature.” Mandia states that the attack would not have been detected by antivirus programs, and the attackers used non-standard strategies to cause damage to the company. “In fact, the scope of this attack differs from any we have responded to in the past, as its purpose was to both destroy property and release confidential information to the public,” Mandia states in the letter, which was leaked to media outlets<http://recode.net/2014/12/07/sony-describes-hack-attack-as-unprecedented/>. “The bottom line is that this was an unparalleled and well planned crime, carried out by an organized group, for which neither SPE nor other companies could have been fully prepared.” Yet, security professionals aren’t buying it. Within 24 hours, several security experts had criticized the statements and refuted Mandia’s characterization of the attacks. “We have tremendous respect for Kevin Mandia and the team he’s assembled at FireEye’s Mandiant, but we completely disagree with the statement he made over the weekend,” Ken Levine, president and CEO of security service provider Digital Guardian, said in an e-mail sent to Ars. “He is clearly offering Sony the opportunity to hide behind the veil of advanced persistent threats.” Another outspoken security researcher, known online as “the grugq,” likened the letter to the Catholic Church selling forgiveness to sinners in the Middle Ages. “TIL [today I learned] Mandiant sells indulgences,” he tweeted on Monday<https://twitter.com/thegrugq/status/541989738580688896>. In some ways, Mandia’s argument reflects the current wisdom in the security industry that, “There are two types of companies: Those that have been breached, and those that don’t know yet that they’ve been breached.” Yet, even for security professionals that accept that mantra, it does not mean that a successful compromise needs to lead to a significant breach, Levine told Ars. “There is a lot of post-breach thinking,” he said. “What we are saying is, not that all breaches are preventable, but what the bad guys get from the breach is absolutely preventable.” In the case of Sony Pictures, the attackers got quite a bit. The entertainment company has reportedly lost control of more than 100 terabytes of data [including unreleased movies, correspondence, contract, and other proprietary supplier, partner, and other industry-related information] without the company, or its security measures, detecting the breach. SPE’s security teams’ inability to catch the attackers in the act of stealing so much data is a direct result of its lack of focus on security, according to a paper by security-services firm Thinkst<http://blog.thinkst.com/2014/12/yabotsb-yet-another-blog-on-sony-breach.html>, outlining the lessons learned from the attack. Thinkst points to a previous statement in 2007<http://www.cio.com/article/2439324/risk-management/your-guide-to-good-enoug…> by Sony’s executive director of information security that it had to focus on making cost-effective security decisions. While the executive, Jason Spaltro, maintained that the company had gone beyond requirements in many places, Thinkst characterized that mindset as focused on “minimum compliance.” “That minimum compliance is the goal speaks volumes  about Sony Pictures’ attitude towards the security of their  data,” the company stated in its analysis. “Sony subsidiaries have fallen victim to tens of successful attacks in recent years, leading us to question the importance of security in the broader conglomerate.” The company has invested mostly in a top-heavy security team, according to other analyses, which—along with the success of so many attacks—suggests that it is not adequately focused on security, according to Thinkst. “What is abundantly clear from the attack is that Sony’s detection and response capabilities were about as poor as possible,” the company stated. “The public timeline of events implies that the intrusion was only discovered when the attackers moved from theft to destruction, announcing their presence bombastically with the altered desktop.” Sony and FireEye declined to comment on the letter or any criticism of the letter. When the details finally become clear, Levine believes that the overall picture will be of a familiar attack. “The truth is, there is nothing new about what these attackers are doing,” he said. “They are using the same tactics they’ve used before to get inside these organizations—someone clicks on an attachment with malware and the malware sits and waits—and FireEye and/or other security products could have, should have caught this, especially given the volume of data that was stolen.”

1 0

INTEREST: Firefox coming to iOS because "that’s where our users are"
by Wayne Billing 05 Dec '14

05 Dec '14

...from: http://arstechnica.com/gadgets/2014/12/firefox-coming-to-ios-because-thats-… https://twitter.com/lsblakk/status/539843892300898304 https://blog.mozilla.org/press/2014/12/designing-a-firefox-experience-for-i… Lukas Blakk ‏@lsblakk We need to be where our users are so we're going to get Firefox on iOS #mozlandia Firefox coming to iOS because that’s where the users are New iOS behavior makes this a little more palatable than before. by Peter Bright<http://arstechnica.com/author/peter-bright/> - Dec 3 2014, 1:17pm CST * Share<https://www.facebook.com/sharer.php?u=http%3A%2F%2Farstechnica.com%2Fgadget…> * Tweet<https://twitter.com/share?text=Firefox+coming+to+iOS+because+that%E2%80%99s…> 68<http://arstechnica.com/gadgets/2014/12/firefox-coming-to-ios-because-thats-…> Saying that Firefox "need[s] to be where [its] users are," it appears that Mozilla is going to produce a version of Firefox for iOS. Mozilla is having a large, week-long working and meeting event in Portland, and TechCrunch<http://techcrunch.com/2014/12/02/firefox-could-soon-come-to-ios/> spotted a couple of tweets coming from Mozilla employees talking about bringing Firefox to iOS. Mozilla Release Manager Lukas Blakk tweeted<https://twitter.com/lsblakk/status/539843892300898304> that Mozilla was going to get Firefox on iOS because that's where its users are. Manager of Data Science Matthew Ruttley tweeted<https://twitter.com/matt_ruttley/status/539844872522301440>, "Firefox for iOS!! Let's do this!!!" (exclamation points all his), and he accompanied the tweet with a photo of a presentation that included a picture of an iPhone. In a brief statement confirming the tweets, Mozilla has announced that it is experimenting<https://blog.mozilla.org/press/2014/12/designing-a-firefox-experience-for-i…> with "something that allows iOS users to be able to choose a Firefox experience." As recently as March 2013<http://arstechnica.com/apple/2013/03/firefox-is-out-of-the-ios-game-until-a…>, Mozilla ruled out bringing Firefox to iOS due to the technical restrictions that Apple imposes on its platform. Then, as now, Apple effectively prohibits the creation of high-performance browser engines on its smartphone operating system through a number of technical restrictions. The only option browser developers have had is to embed Apple's own WebKit and provide a custom user interface around that. Prior to the release of iOS 8, even this option was unappealing, as the embedded WebKit did not have access to the high-performance JavaScript engine that the built-in Safari includes. While the former restriction hasn't been lifted, iOS 8 allows the embedded WebKit to use the full-power JavaScript engine, and as such, it means that third-party browser front-ends no longer operate at a performance disadvantage relative to Safari. Using Apple's WebKit—as Google has done with its Chrome for iOS—still allows Mozilla to plumb in its own interface, password and bookmark syncing, and other features. This will give Firefox users the same kind of cross-platform experience that users of some other browsers enjoy. Mozilla Press Center Mozilla News, Announcements, and More Mozilla Designing a Firefox Experience for iOS DEC 2 2014 At Mozilla, we put our users first and want to provide an independent choice for them on any platform. We are in the early stages of experimenting with something that allows iOS users to be able to choose a Firefox experience. We work in the open at Mozilla and are just starting to experiment with a couple of different concepts, so we’ll update you when we have more to share. ......seems things have changed at Mozillia since 20 September 2013, at 08:07 https://wiki.mozilla.org/Mobile/Platforms iPhone/iPad/iPod We have no plans to release the full Firefox browser for iOS. The iOS SDK agreement requires apps to use Apple's own JavaScript engine (or none at all, like Opera Mini which downloads pre-rendered pages from Opera's servers and cannot run JavaScript code in the client). Because of this, we have no supported way to distribute Firefox's rendering and JavaScript engine to iPhone users.

1 0

FYI: Nature makes all articles free* to view
by Wayne Billing 02 Dec '14

02 Dec '14

[* - well, free to subscribers..... others, sort of....] ...from: http://www.nature.com/news/nature-makes-all-articles-free-to-view-1.16460 Nature makes all articles free to view [cid:286F8AB4-65F7-4822-857F-8D57B280E401]<http://www.nature.com/news/dummy-jpg-7.22111?article=1.16460> Annthea Lewis/Nature Nature will make its articles back to 1869 free to share to be read online but not to be printed or downloaded. All research papers from Nature will be made free to read in a proprietary screen-view format that can be annotated but not copied, printed or downloaded, the journal’s publisher Macmillan announced<http://www.nature.com/press_releases/share-nature-content.html> on 2 December. The content-sharing policy, which also applies to 48 other journals in Macmillan’s Nature Publishing Group (NPG) division, including Nature Genetics, Nature Medicine and Nature Physics, marks an attempt to let scientists freely read and share articles while preserving NPG’s primary source of income — the subscription fees libraries and individuals pay to gain access to articles. ReadCube<https://www.readcube.com/>, a software platform similar to Apple’s iTunes, will be used to host and display read-only versions of the articles' PDFs. If the initiative becomes popular, it may also boost the prospects of the ReadCube platform, in which Macmillan has a majority investment. Annette Thomas, chief executive of Macmillan Science and Education, says that under the policy, subscribers can share any paper they have access to through a link to a read-only version of the paper’s PDF that can be viewed through a web browser. For institutional subscribers, that means every paper dating back to the journal's foundation in 1869, while personal subscribers get access from 1997 on. Anyone can subsequently repost and share this link. Around 100 media outlets and blogs will also be able to share links to read-only PDFs. Although the screen-view PDF cannot be printed, it can be annotated — which the publisher says will provide a way for scientists to collaborate by sharing their comments on manuscripts. PDF articles can also be saved to a free desktop version of ReadCube, similarly to how music files can be saved in iTunes. “We know researchers are already sharing content, often in hidden corners of the Internet or using clumsy, time-consuming practices,” said a statement by Timo Hannay, the managing director of Digital Science, a division of Macmillan that has invested in ReadCube. “At Digital Science we have the technology to provide a convenient, legitimate alternative that allows researchers to access the information they need and the wider, interested public access to scientific knowledge, from the definitive, original source,” Hannay said. The policy comes as research funders are increasingly mandating that scientists make their papers free to read, download and reuse in various other ways. Natureand its sister journals already allow scientists to freely archive online the peer-reviewed manuscripts of their papers, but only after a delay of six months following publication. And papers published in some NPG journals — 38% of all papers NPG published this year, says Thomas — are already being made free to read immediately on publication, a ‘gold open-access’ model in which publishers charge authors or their funders, rather than subscribers, for publishing each paper. But Thomas says that she expects that the subscription and the open-access business models would exist side by side for a long time to come. Philip Campbell, the editor-in-chief of Nature and the other Nature-branded journals, has said that Nature's internal costs of publishing<http://www.nature.com/doifinder/10.1038/495426a> run at £20,000–30,000 (US$31,000–47,000) per paper, an extremely high charge to load onto authors or funders rather than spread over subscribers. Initial reactions to the policy have been mixed. Some note that it is far from allowing full open access to papers. “To me, this smacks of public relations, not open access,” says John Wilbanks, a strong advocate of open-access publishing in science and a senior fellow at the Ewing Marion Kauffman Foundation in Kansas City, Missouri. “With access mandates on the march around the world, this appears to be more about getting ahead of the coming reality in scientific publishing. Now that the funders call the tune and the funders want the articles on the web at no charge, these articles are going to be open anyway,” he says. Peter Suber, director of the Office for Scholarly Communication at Harvard University in Cambridge, Massachusetts, says that the programme is a step forward. But, he notes, if authors prefer to share links to PDFs rather than actually deposit their manuscripts in an online repository, the programme could be a step backward, because repositories host copies independently from the publisher, and those copies can be printed or saved and are generally more reusable than a screen-only file. Thomas says that the publisher intends the policy as a pilot and will be evaluating it over the coming year. She says that she expects libraries and personal users to continue to subscribe to the journal, but also that scientists would embrace the new sharing model. Other science publishers, such as Wiley, use ReadCube to display preview versions of their papers, so it is possible that the same idea might spread to others, Thomas adds.

1 0

FYI: Autodesk Makes Software Free to Schools Worldwide
by Wayne Billing 02 Dec '14

02 Dec '14

....from: http://news.autodesk.com/press-release/autodesk-consumer-group-and-educatio… Autodesk Makes Design Software Free to Schools Worldwide Design Software Leader Expands Reach of Free Education Offering to Prepare an Industry-ready Workforce LAS VEGAS--(BUSINESS WIRE<http://www.businesswire.com/>)--Fulfilling its promise to expand access to its professional design software in education, Autodesk, Inc.<http://cts.businesswire.com/ct/CT?id=smartlink&url=http%3A%2F%2Fwww.autodes…> (NASDAQ:ADSK) has made its industry-leading design, engineering and entertainment software free* to students, instructors and academic institutions worldwide. Through this action, more than 680 million students and educators from over 800,000 secondary and post-secondary schools in 188 countries can take advantage of free access to Autodesk’s professional software and services for use in classrooms, labs, and at home. “The way we make things is changing rapidly, and we need a workforce ready to design for new manufacturing and construction techniques. By providing free professional design tools to students, faculty members and academic institutions around the world, we’re helping get industry ready for the next phase,” said Carl Bass, CEO, Autodesk. Following its announcement<http://cts.businesswire.com/ct/CT?id=smartlink&url=http%3A%2F%2Fnews.autode…> of free software for academic institutions in the United States earlier this year as part of President Obama’s ConnectED initiative, Autodesk has gradually expanded free access to its leading design software to academic institutions across Asia Pacific and Europe. The leader in 3D design, engineering, and entertainment software is also helping schools move to the cloud by providing academic institutions with its full suite of next generation cloud-based design products, cloud services such as the A360<http://cts.businesswire.com/ct/CT?id=smartlink&url=http%3A%2F%2Fwww.autodes…> collaboration platform, as well as maintenance subscription for free. From students as young as 13 years old leveraging Fusion 360<http://cts.businesswire.com/ct/CT?id=smartlink&url=http%3A%2F%2Ffusion360.a…> to conceptualize and 3D print prosthetic devices<http://cts.businesswire.com/ct/CT?id=smartlink&url=http%3A%2F%2Finthefold.a…>, to college teams developing environmentally sustainable homes<http://cts.businesswire.com/ct/CT?id=smartlink&url=http%3A%2F%2Finthefold.a…> using BIM 360 Glue<http://cts.businesswire.com/ct/CT?id=smartlink&url=http%3A%2F%2Finthefold.a…>, young talent are pushing the boundaries of design and innovation both inside and outside of the classroom using the same design software used by professionals every day. “Our students are using Fusion 360 to design an Energy Scooter which we are bringing to market via Kickstarter<http://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Fwww.kickst…>, and they’re only in 8th grade! If we can help more classroom teachers incorporate learning through design in their curriculum, and technologies that engage students in problem-solving through engineering, students will see how math and science are springboards to careers as future innovators and entrepreneurs,” said Karen Kaun, Founder of Makeosity. To facilitate the integration of design tools into curricula, Autodesk also offers free project-based learning content and resources including the Digital STEAM Workshop<http://cts.businesswire.com/ct/CT?id=smartlink&url=http%3A%2F%2Fdigitalstea…> and Design Academy<http://cts.businesswire.com/ct/CT?id=smartlink&url=http%3A%2F%2Facademy.aut…>. “Closing the digital gap in education starts by providing European schools with common access to the same advanced technology being used by industry professionals today. Autodesk’s pledge<http://cts.businesswire.com/ct/CT?id=smartlink&url=http%3A%2F%2Fec.europa.e…> to provide our schools, students and teachers with free access to its professional 3D design software will enable educators to introduce design thinking into our classrooms; equip digital natives with the design tools to learn to solve real-world challenges in new creative ways; and prepare the next-generation workforce with the 21st century skills to meet industry demands and advance our economies,” said Neelie Kroes, former vice-president of the European Commission. To learn more or to request free educational access to Autodesk software, visit http://www.autodesk.com/education<http://cts.businesswire.com/ct/CT?id=smartlink&url=http%3A%2F%2Fwww.autodes…>. About Autodesk Autodesk helps people imagine, design and create a better world. Everyone—from design professionals, engineers and architects to digital artists, students and hobbyists—uses Autodesk software to unlock their creativity and solve important challenges. For more information visit autodesk.com<http://cts.businesswire.com/ct/CT?id=smartlink&url=http%3A%2F%2Fautodesk.co…> or follow @autodesk<http://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Ftwitter.co…>. Autodesk, the Autodesk logo, A360, BIM 360 and Fusion 360, are registered trademarks or trademarks of Autodesk, Inc., and/or its subsidiaries and/or affiliates in the USA and/or other countries. All other brand names, product names or trademarks belong to their respective holders. Autodesk reserves the right to alter product and services offerings, and specifications and pricing at any time without notice, and is not responsible for typographical or graphical errors that may appear in this document. © 2014 Autodesk, Inc. All rights reserved. * - Free Autodesk software and/or cloud-based services may only be used for educational purposes and are subject to acceptance of and compliance with the terms and conditions of the software license agreement or terms of service.Details and restrictions available at http://usa.autodesk.com/legal-notices-trademarks<http://cts.businesswire.com/ct/CT?id=smartlink&url=http%3A%2F%2Fusa.autodes…>. Photos/Multimedia Gallery Available: http://www.businesswire.com/multimedia/home/20141201005128/en/

1 0

INTEREST: Microsoft to unveil Windows 10 consumer features at January event
by Wayne Billing 29 Nov '14

29 Nov '14

...from: http://www.theverge.com/2014/11/27/7298717/windows-10-consumer-features-jan… Microsoft to unveil Windows 10 consumer features at January event Consumer Preview is on the way * By Tom Warren<http://www.theverge.com/users/tomwarren> * on November 27, 2014 10:10 am * @tomwarren<https://twitter.com/intent/user?screen_name=tomwarren> * 85<http://www.theverge.com/2014/11/27/7298717/windows-10-consumer-features-jan…> [windows10jay.0.0.jpg] Microsoft is planning to detail the consumer features of Windows 10 at an event in January. While Microsoft will be present at the Consumer Electronics Show in early January, sources familiar with the company’s plans tell The Verge that Microsoft will hold a separate press event in late January to unveil the consumer preview of Windows 10. Microsoft previously promised "early 2015<http://blogs.windows.com/bloggingwindows/2014/09/30/announcing-windows-10/>" for a discussion on consumer features, and it appears the company is on track. Microsoft’s first unveiling of Windows 10 was a small low-key event in San Francisco<http://live.theverge.com/microsoft-windows-9-event-live-blog/>that lasted around an hour, but we’re told the company’s consumer feature unveiling will be more significant. Microsoft has a large number of features to discuss, including a new touch interface dubbed Continuum<http://www.theverge.com/2014/9/30/6873963/windows-10-continuum-touch-interf…>. The software giant will also detail its plans for Windows phones and tablets, and possibly dashboard updates for its Xbox One gaming console. Windows 10 is designed to run across multiple devices, including PCs, tablets, phones, and the Xbox One. We understand Microsoft will announce the details of its Windows 10 consumer event before the end of the year. More Windows 10 Information: http://technet.microsoft.com/en-us/windows/windows10.aspx Wayne Billing Classroom Technology Support Audio Visual and Classroom Technology Support Computer and Network Support 130 Machray Hall Building 204-474-6649 204-807-3153 (cell) 204-474-7625 (fax) Wayne_Billing(a)umanitoba.ca<mailto:Wayne_Billing@umanitoba.ca>

1 0

INTEREST: European parliament: "Break up Google"; US lawmakers ask to not break up Google
by Wayne Billing 28 Nov '14

28 Nov '14

...from: http://arstechnica.com/tech-policy/2014/11/european-parliament-votes-in-fav… European parliament votes in favor of breaking up Google [cid:5ADFFBCA-0F87-4B7D-9B3C-51F70D0B6494] Trey Ratcliff / flickr<http://www.flickr.com/photos/stuckincustoms/4323977677/> In a vote on Thursday, European Parliament members voted 384 to 174 in favor<http://www.reuters.com/article/2014/11/27/eu-google-idUSL6N0TH2FS20141127> of a resolution that calls for the unbundling of search engines from other commercial services to ensure competition among online companies. Although Google is not named specifically in the resolution, it's clearly targeted at the dominant search engine. The resolution would still have to be approved by the European Commission, the executive branch of the European Union, to take effect, but the overwhelming vote in favor of separating search from other online products increases the likelihood that Google could face a major regulatory headache. In a press release<http://www.europarl.europa.eu/news/en/news-room/content/20141125IPR80501/ht…>, the European Parliament called on EU member states and the European Commission to “break down barriers to the growth of the EU's digital single market” (a “single market” refers to the EU as an association of 28 countries trading freely between each other without restrictions). The Parliament also “stressed the need to prevent online companies from abusing dominant positions.” Lawmakers expressed concern, in particular, that Google was using its dominance to promote its own services unfairly and to obscure the services of its competitors. In the resolution, the Parliament asked the European Commission “to prevent any abuse in the marketing of interlinked services by operators of search engines,'” and asserted that "Indexation, evaluation, presentation, and ranking by search engines must be unbiased and transparent.” Reuters reports that European Competition Commissioner Margrethe Vestager “has said she will review the case and talk to complainants before deciding on the next step.” Earlier this month, when the Financial Times reported<http://arstechnica.com/tech-policy/2014/11/europes-parliament-poised-to-cal…> on the draft resolution, it noted that the European Commission has been investigating Google for unfair practices for years. Earlier this week, US lawmakers urged<http://arstechnica.com/tech-policy/2014/11/us-lawmakers-ask-europe-not-to-b…> the European Parliament not to vote to break up Google. Google declined to comment<http://www.reuters.com/article/2014/11/27/eu-google-idUSL6N0TH2FS20141127> to Reuters. Ars has contacted Google and will update if we receive a response. This is only the latest in a slew of troubles Google has had with European regulators. It has also seen regulation, fines, and warnings from Europe with respect to taxation, copyright concerns, and the “right to be forgotten<http://arstechnica.com/tech-policy/2014/05/google-must-erase-inadequate-lin…>.” ...from: http://arstechnica.com/tech-policy/2014/11/us-lawmakers-ask-europe-not-to-b… US lawmakers ask Europe not to break up Google European parliament considering a nonbinding resolution to unbundle search engines. by Jon Brodkin<http://arstechnica.com/author/jon-brodkin/> - Nov 26 2014, 10:50am CST * Share<https://www.facebook.com/sharer.php?u=http%3A%2F%2Farstechnica.com%2Ftech-p…> * Tweet<https://twitter.com/share?text=US+lawmakers+ask+Europe+not+to+break+up+Goog…> 134<http://arstechnica.com/tech-policy/2014/11/us-lawmakers-ask-europe-not-to-b…> [cid:DA28E3AB-355C-4A9E-9DBD-70C0B0BCA57D] keso s<http://www.flickr.com/photos/keso/108805307/> A European proposal to unbundle search engines from other commercial businesses—which could result in the breakup of Google—has brought a response from US lawmakers. "Capitol Hill hit back at EU lawmakers on Tuesday for politicizing an antitrust investigation into Google, as tensions rose ahead of a European parliamentary vote calling for the possible break-up of the technology group," the Financial Times reported last night<http://www.ft.com/intl/cms/s/0/3d903290-74c9-11e4-a418-00144feabdc0.html#ax…>. Lawmakers sent letters to European counterparts expressing alarm at the proposal. The letters don't specifically mention Google, the world's largest search company, but neither does the European draft resolution. That says the European Commission should "consider proposals with the aim of unbundling search engines from other commercial services." The resolution in the European parliament is likely to pass on Thursday, but it would be nonbinding, because any final action would have to be taken by the European Commission, the executive branch of the European Union. One European member of parliament argued that "search engines like Google should not be allowed to use their market power to push forward other commercial activities of the same company.” However, EU digital commissioner Günther Oettinger spoke out against a breakup of Google. US House Judiciary Committee Chairman Bob Goodlatte (R-VA) wrote<http://judiciary.house.gov/_cache/files/930df244-ccf0-44c6-965d-6f91712adb2…> to European members of parliament, calling himself "troubled to learn that some European elected representatives are encouraging antitrust enforcement efforts that appear to be motivated by politics, rather than grounded in factual and legal principles. We believe that antitrust enforcement should be applied independent of politics and firmly rooted in our shared international principles. Policies that run counter to these principles undermine our free markets and ultimately harm both our businesses and our consumers." Another letter from US lawmakers said "'proposals that seem to target US technology companies' raised questions 'about the EU’s commitment to open markets,'" the Financial Times reported. The letter was signed by Senators Ron Wyden (D-OR) and Orrin Hatch (R-UT) and Reps. Dave Camp (R-MI) and Sander Levin (D-MI). A third letter<http://eshoo.house.gov/uploads/Letter%20from%20U%20S%20%20Congressional%20D…> signed by 12 members of US Congress led by Rep. Anna Eshoo (D-CA) said the resolution "would deter continued innovation and investment from US based Internet companies." The letter described "the transformative impact of online based services, including e-mail, social media, and search on our society and the economy," plus the contributions of US companies to the European economy. "It is therefore troubling to us that the European Parliament is suggesting an action that would stem cross-border data flows at the expense of millions of people across Europe who enjoy the use of these online services every day," the letter states. "We support healthy competition and a fair playing field for Internet companies in the US and around the globe, and we believe these goals can be accomplished through the traditional regulatory process."

1 0

FYI: Malware’s new target: your password manager’s password
by Wayne Billing 19 Nov '14

19 Nov '14

...from: http://arstechnica.com/security/2014/11/citadel-attackers-aim-to-steal-vict… Malware’s new target: your password manager’s password Citadel trojan attempts to grab your master key. by Robert Lemos<http://arstechnica.com/author/roblemos/> - Nov 19 2014, 12:42pm CST * Share<https://www.facebook.com/sharer.php?u=http%3A%2F%2Farstechnica.com%2Fsecuri…> * TweetCyber criminals have started targeting the password managers that protect an individual's most sensitive credentials by using a keylogger to steal the master password in certain cases, according to research from data-protection company IBM Trusteer.<https://twitter.com/share?text=Malware%E2%80%99s+new+target%3A+your+passwor…> Cyber criminals have started targeting the password managers that protect an individual's most sensitive credentials by using a keylogger to steal the master password in certain cases, according to research from data-protection company IBM Trusteer. The research<http://securityintelligence.com/cybercriminals-use-citadel-compromise-passw…> found that a configuration file, which attackers use to tailor the Citadel trojan for specific campaigns, had been modified to start up a keylogger when the user opened either Password Safe or KeePass, two open-source password managers. While malware has previously targeted the credentials stored in the password managers included in popular Web browsers, third-party password managers have typically not been targeted. While the current impact of the attack is low, the implications of the attacker’s focus is that password managers will soon come under more widespread assault, Dana Tamir, director of enterprise security for IBM Trusteer, told Ars Technica. “Once the malware captures this master key, then they can use that master key to exercise complete control over the machine and any of the user’s online accounts,” she said. Cyber criminals have increasingly focused on stealing passwords from online repositories and services. Passwords are generally not considered an adequate security solution for important data or online services because easy-to-remember passwords are also easier to guess, reducing the security of the protected data. Password managers boost the security of online accounts by allowing users to create a different and complex password for each of their accounts, additionally encrypting the information to prevent access. But the technology is not foolproof, as researchers found this summer when they published details of flaws<http://arstechnica.com/security/2014/07/severe-password-manager-attacks-ste…> in five different programs for storing passwords. Yet, when implemented correctly, the software can allow individuals to securely store a different credential for every site and system they use, avoiding reusing keys. It's no surprise, then, that attackers have started targeting that master key. The Citadel configuration files found by the IBM researchers commanded the malware to begin keylogging whenever Password Safe or KeePass started running. The system also monitored for passwords to an authentication solution known as the neXus Personal Security Client. The master passwords, if captured by the program, were sent to a legitimate Web server that appeared to have been compromised by the attackers. It was not clear whether the attack was part of a targeted campaign or just opportunistic attackers aiming to grab credentials from users of the password managers, IBM Trusteer’s Tamir said. Despite the attack, password managers are still better than just using a few passwords, or worse, a single password, she said. “I think that password managers and authentication solutions are more critical than ever,” Tamir said. “But it is important to keep in mind that these solutions are not sufficient in and of themselves—they have to be accessed from a clean machine.” Wayne Billing Classroom Technology Support Audio Visual and Classroom Technology Support Computer and Network Support 130 Machray Hall Building 204-474-6649 204-807-3153 (cell) 204-474-7625 (fax) Wayne_Billing(a)umanitoba.ca<mailto:Wayne_Billing@umanitoba.ca>

1 0

FYI: Mozilla/FireFox to drop Google default
by Wayne Billing 19 Nov '14

19 Nov '14

...from: http://arstechnica.com/information-technology/2014/11/mozilla-ends-google-r… Mozilla ends Google relationship, Firefox will now default to Yahoo in the US Ten-year partnership that paid most of Mozilla's bills coming to an end. by Peter Bright<http://arstechnica.com/author/peter-bright/> - Nov 19 2014, 5:10pm CST * Share<https://www.facebook.com/sharer.php?u=http%3A%2F%2Farstechnica.com%2Finform…> * Tweet<https://twitter.com/share?text=Mozilla+ends+Google+relationship%2C+Firefox+…> 53<http://arstechnica.com/information-technology/2014/11/mozilla-ends-google-r…> Since 2004, Google has been paying Mozilla a ton of money each year—estimated at around $100 million<http://www.zdnet.com/blog/bott/firefox-faces-uncertain-future-as-google-dea…>—for the privilege of being the default search engine used in the Firefox browser. This contribution represented the lion's share of Mozilla's income, something in the ballpark of 85 percent. That deal, last renewed for a three-year period in 2011, has come to an end, and this time it won't be renewed. Mozilla announced today<https://blog.mozilla.org/blog/2014/11/19/promoting-choice-and-innovation-on…> that the free browser vendor is switching to a range of different search providers. In the US, Firefox will now default to using Yahoo<http://yahoo.tumblr.com/post/103069386424/yahoo-and-mozilla-partner-to-brin…> (which continues to be powered by Microsoft's Bing engine); in Russia it will use Yandex<https://twitter.com/andreasgal/status/535193708518715392>, and in China, Baidu. Mozilla and Yahoo have signed a five-year deal. As part of the deal, Yahoo is going to start honoring the Do Not Track feature when used by Firefox users to limit Yahoo's ability to track user activity across the Web through advertisements. Yahoo is also going to roll out a new search interface for American Firefox users, starting in December. Financial terms of the new five-year deal have not been announced. Wayne Billing Classroom Technology Support Audio Visual and Classroom Technology Support Computer and Network Support 130 Machray Hall Building 204-474-6649 204-807-3153 (cell) 204-474-7625 (fax) Wayne_Billing(a)umanitoba.ca<mailto:Wayne_Billing@umanitoba.ca>

1 0

INTEREST: Google Wallet ending online prescence
by Wayne Billing 14 Nov '14

14 Nov '14

Last month Apple announced ApplePay in the USA. (Coming to Canada early 2015) This month, Google has just announced that their electronic pay system "Google Wallet" won't work online starting March, 2015. Is Google offering a replacement product? No, Google is not offering a replacement processing solution for digital goods on websites. ...from: http://www.engadget.com/2014/11/13/google-wallet-digital-goods-shutdown/?nc… https://support.google.com/wallet/business/answer/6107573 Google Wallet won't let you buy digital goods on the web past March 2015 [cid:AB6D7D91-270F-4E30-8186-9ED65408E17D]<http://www.engadget.com/2014/11/13/google-wallet-digital-goods-shutdown/> Sad news, web merchants: if you relied on Google Wallet to process the online payments for your feline subculture e-zine (or any other digital product you've got kicking around), you'd better start looking for something else to do the job. On March 2, 2015, Google will officially pull the plug on its Wallet for Digital Goods API, which means anyone who hasn't switched to another payment processor -- like PayPal, for instance -- will be serve up 404s left and right to anyone trying to buy stuff from them. Why? Mostly because the "industry has matured a lot" since the thing launched back in 2012<http://www.engadget.com/2012/10/04/google-wallet-reaches-the-web-reminds-mo…>, meaning that Google's facing some seriously stiff competition and doesn't feel up to the fight. Don't panic, though: let's just take a moment to run through what's happening and to whom. You can still use your NFC-laden Android phone to pay for your Haribo cola gummies down at the local Wawa - that's a completely separate part of the business. You can still process in-app payments through Google Wallet if you're a developer, too, because the last thing Google needs is to pull the rug out from under the app creators that make them money. And yes, you can still use Google Wallet online to buy physical products, like, say, a Domino's Pizza. Thank heavens for that, right?

1 0

FYI: Apple downplays risk of new malware attack; recommendations
by Wayne Billing 14 Nov '14

14 Nov '14

...from: http://www.cbc.ca/news/technology/apple-downplays-risk-of-masque-attack-aft… Apple downplays risk of Masque Attack after U.S. government warning ['We designed OS X and iOS with built-in security safeguards to help protect customers and warn them before installing potentially malicious software,' Apple said in an official statement.] 'We designed OS X and iOS with built-in security safeguards to help protect customers and warn them before installing potentially malicious software,' Apple said in an official statement. (Hannah Yoon/ Canadian Press) Apple is downplaying a risk of a security bug in its mobile operating system for iPhones and iPads that the U.S. Department of Homeland Security warned users about yesterday. The United States Computer Emergency Readiness Team, based at the Department of Homeland Security, issued an alert<https://www.us-cert.gov/ncas/alerts/TA14-317A> Thursday about the Apple iOS "Masque Attack" technique<http://www.cbc.ca/news/technology/apple-ios-bug-makes-iphones-ipads-vulnera…>, announced by the internet security firm FireEye in a blog post Nov. 10<http://www.fireeye.com/blog/technical/cyber-exploits/2014/11/masque-attack-…>. FireEye said the technique allows hackers to replace one of the users' existing apps with malware, for example, replacing a user's banking and email apps with malware that sends banking and email data directly to the attackers. The company said recent Wirelurker attacks<http://www.cbc.ca/news/technology/apple-devices-hit-by-wirelurker-malware-i…> in China started to use a "limited form" of Masque Attacks to attack iOS devices via a USB connection. But in an official statement emailed to CBC News on Friday, Apple said, "We’re not aware of any customers that have actually been affected by this attack." The company added, "We designed OS X and iOS with built-in security safeguards to help protect customers and warn them before installing potentially malicious software." The statement came more than three days after CBC News sent Apple an email request for comment about FireEye's blog post<http://www.fireeye.com/blog/technical/cyber-exploits/2014/11/masque-attack-…>. In response to the Apple statement, Vitor de Souza, vice-president of global communications for FireEye, noted that with most cyberattacks, the victim doesn't know they have been compromised. "We are not saying that this is a widespread attack, but we believe consumers should be aware so they take the necessary precaution," he added in an email to CBC News on Friday. But Chris Mills, a writer for the technology website Gizmodo, wrote that he thinks the attack is "not anything to worry about." "See, the 'attack' requires the user to first follow a dodgy-looking link, then click past an iOS pop-up warning people about downloading malicious apps. Not to mention, the hacker needs access to an iOS Developer Enterprise Program account," he wrote. "If we pretend that ignoring the built-in safeguards and then downloading dodgy apps is a security flaw, then every single major operating system, mobile or otherwise, has a security flaw." However, users commenting on the article disagreed, Apple recommended that in order to protect themselves: * Customers should only download from "trusted sources like the App Store." * Users should pay attention to warnings when they download apps. * Enterprise users should install custom business app from their company's secure website<http://support.apple.com/en-us/HT6584>.

1 0