Category: Uncategorised

Enlarge (credit: Aviram et al.)

More than 13 million websites and e-mail services protected by the transport layer security protocol are vulnerable to a newly discovered, low-cost attack that decrypts sensitive communications in a matter of hours and in some cases almost immediately, an international team of researchers warned Tuesday. More than 97,000 of the top 1 million most popular Web properties are among the vulnerable HTTPS-protected sites.

The attack works against TLS-protected communications that rely on the RSA cryptosystem when the key is exposed even indirectly through SSLv2, a TLS precursor that was retired almost two decades ago because of crippling weaknesses. The vulnerability allows an attacker to decrypt an intercepted TLS connection by repeatedly using SSLv2 to make connections to a server. In the process, the attacker learns a few bits of information about the encryption key each time. While many security experts believed the removal of SSLv2 support from browser and e-mail clients prevented abuse of the legacy protocol, some misconfigured TLS implementations still tacitly support the legacy protocol when an end-user computer specifically requests its use. The most notable implementation subject to such fatal misconfigurations is the OpenSSL cryptographic library, which on Tuesday is expected to release an update that makes such settings much less likely to occur.

Recent scans of the Internet at large show that more than 5.9 million Web servers, comprising 17 percent of all HTTPS-protected machines, directly support SSLv2. The same scans reveal that at least 936,000 TLS-protected e-mail servers also support the insecure protocol. That's a troubling finding, given widely repeated advice that SSLv2—short for secure sockets layer version 2—be disabled. More troubling still, even when a server doesn't allow SSLv2 connections, it may still be susceptible to attack if the underlying RSA key pair is reused on a separate server that does support the old protocol. A website, for instance, that forbids SSLv2 may still be vulnerable if its key is used on an e-mail server that allows SSLv2. By the researchers' estimate, that leaves 13.6 million HTTPS-protected websites and a significant number of TLS-protected e-mail servers open to attack.

Enlarge / Trying out a nonfunctional Glyph prototype at CES 2015. Props to the Avegant people, because the shipping model looks pretty much exactly like this. (credit: Lee Hutchinson)

The Avegant Glyph is a screen that you wear on your face. That’s the simplest way to describe it. The whole device looks like a pair of outsized Beats headphones, complete with huge chunky body and thick plastic headband; the parts that go on your ears are indeed headphones, but that huge headband hides a 720p DLP screen (though "screen" isn’t quite right, as we’ll see) and the optics necessary to make the display work.

When you put it on, you look a lot like you’re wearing someone’s parody of what a VR headset is supposed to look like (personally, I think the effect rather resembles the popular "cyber woman with corn" stock photo). But the technology actually delivers a very high fidelity image—and for a first-generation hardware project borne of a Kickstarter, even delivering a product at all can be considered a success. Viewed through that lens, the Glyph is a hit.

But after spending a week with a "Founder’s Edition" version of the headset, I’m not entirely sure I’d want to spend the money for one—and it might not be for the reason you’re expecting.

WDATP can detect anomalous behavior even when the malware scanner doesn't find anything wrong. (credit: Microsoft)

Microsoft is beefing up Windows Defender, the anti-malware program that ships with Windows 10, to give it the power to tell companies that they've been hacked after it has happened.

Attacks that depend on social engineering rather than software flaws, as well as those taking advantage of unpatched zero-day vulnerabilities, can evade traditional anti-malware software. Microsoft says that there were thousands of such attacks in 2015, and that on average they took 200 days to detect, and a further 80 days to contain, giving attackers ample time to steal data, and incurring average costs of $12 million per incident. The catchily named Windows Defender Advanced Threat Protection is designed to detect this kind of attack, not by looking for specific pieces of malware, but rather by detecting system activity that looks out of the ordinary.

For example, a social engineering attack might encourage a victim to run a program that was attached to an e-mail, or execute a suspicious looking PowerShell command. The Advanced Persistent Threat (APT) software that's typically used in such attacks may scan ports, connect to network shares to look for data to steal, or to remote systems to seek new instructions and exfiltrate data. Windows Defender Advanced Threat Protection can monitor this behavior and see how it deviates from normal, expected system behavior. The baseline is the aggregate behavior collected anonymously from more than 1 billion Windows systems. If systems on your network start doing something that the "average Windows machine" doesn't, WDATP will alert you.