Month: December 2015

(credit: Power Ventures)

SAN FRANCISCO—A panel of three federal appellate judges appeared generally skeptical on Wednesday as forgotten social networking startup Power Ventures claimed that the company and its former CEO are not liable for violating an anti-spam and an anti-hacking law. A lower court previously ruled in favor of Facebook, which brought the original case, and issued an award of $3 million to the social network giant.

Back in 2008 when the original suit was filed, Power.com attempted to be a one-stop-shop for all social networks—its users could post to Facebook and other sites all in one place.

But as part of its "Power 100" campaign, Power Ventures offered its customers the chance to win $100 if they invited 100 friends to join. In so doing, Power Ventures sent messages through Facebook that came from @facebookmail.com and appeared to come from "The Facebook Team," giving the impression that they had come from Facebook itself. Facebook attempted to block this activity through an IP block, which Power Ventures circumvented. When Power Ventures ignored Facebook’s requests to cease-and-desist, Facebook then filed a lawsuit in 2008.

(credit: Special Committee on Aging)

In the first of what will be a series of hearings on sudden price hikes of off-patent drugs, the Senate’s Special Committee on Aging on Wednesday made no attempt to veil their contempt for Turing Pharmaceuticals and its ilk.

“My biggest challenge today, is to not lose my temper,” Sen. Claire McCaskill (D-Mo.), ranking member of the committee, said in her opening statement. “The facts that are underlying this hearing are so egregious that it is hard not to get emotional about it.”

McCaskill went on to openly mock Martin Shkreli, CEO and founder of Turing, for callously raising prices while spending millions to be the sole owner of a Wu-Tang Clan album. (Later in the hearing, she simply referred to Shkreli as “Mr. Wu-Tang.”)

(credit: Michael Rivera)

Tens of millions of Internet users will be cut off from encrypted webpages in the coming months unless sites are permitted to continue using SHA1, a cryptographic hashing function that's being retired because it's increasingly vulnerable to real-world forgery attacks, Facebook and Web security company CloudFlare have warned.

Facebook said as many as seven percent of the world's browsers are unable to support the SHA256 function that serves as the new minimum requirement starting at the beginning of 2016. That translates into tens of millions of end users, and a disproportionate number of them are from developing countries still struggling to get online or protect themselves against repressive governments. CloudFlare, meanwhile, estimated that more than 37 million people won't be able to access encrypted sites that rely on certificates signed with the new algorithm.

Both companies went on to unveil a controversial fallback mechanism that uses SHA1-based certificates to deliver HTTPS-encrypted webpages to people who still rely on outdated browsers. The remaining, much larger percentage of end users with modern browsers would be served HTTPS pages secured with SHA256 or an even stronger function. The mechanisms, which both companies are making available as open-source software, will allow websites to provide weaker HTTPS protection to older browsers while giving newer ones the added benefits of SHA256. Facebook is deploying the plan on most or all of the sites it operates, while CloudFlare will enable it by default for all of its customers. CloudFlare said other sites, including those run by Chinese portal Alibaba, are also implementing it.

A voyage data recorder recovery capsule aboard a container ship. Some VDRs may be an easy target for hackers--or crew members who don't want what they've done to be recorded. (credit: Hervé Cozanet)

When the freighter El Faro was lost in a hurricane on October 1, one of the goals of the salvage operation was to recover its voyage data recorder (VDR)—the maritime equivalent of the "black box" carried aboard airliners. The VDR, required aboard all large commercial ships (and any passenger ships over 150 gross tons), collects a wealth of data about the ship's systems as well as audio from the bridge of the ship, radio communications, radar, and navigation data. Writing its data to storage within a protective capsule with an acoustic beacon, the VDR is an essential part of investigating any incident at sea, acting as an automated version of a ship's logbook.

Sometimes, that data can be awfully inconvenient. While the data in the VDR is the property of the ship owner, it can be taken by an investigator in the event of an accident or other incident—and that may not always be in the ship owner's (or crew's) interest. The VDRs aboard the cruise ship Costa Concordia were used as evidence in the manslaughter trial of the ship's captain and other crewmembers. Likewise, that data could be valuable to others—especially if it can be tapped into live.

It turns out that some VDRs may not be very good witnesses. As a report recently published by the security firm IOActive points out, VDRs can be hacked, and their data can be stolen or destroyed.