Multiple Google Services Experience 90-Minute Disruption

Found on eWEEK on Tuesday, 26 January 2016
Browse Internet

Reports on Google's App Status dashboard show the disruption lasted for about 90 minutes before the company was able to restore normal service levels.

Last September, for instance, Amazon Web Services, which is regarded as having one of the best cloud service uptimes in the industry, experienced problems with its DynamoDB database service. The disruption lasted for 5 hours and seriously affected services at Netflix, Viber, Reddit and multiple other sites.

Azure customers had to suffer through nearly 36 hours of intermittent service before Microsoft was able to address the issue.

You cannot expect any service to have a 100% uptime. Remember that next time you complain about a 5 minute outage or busy service.

Interview: John Matherly on Check Point Blacklisting Shodan

Found on Softpedia on Sunday, 24 January 2016
Browse Internet

Check Point has completely ignored the fact that Shodan is also used by the good guys, and that tools similar to Shodan have existed long before the service, most of which were developed by cybercrime groups.

Instead of focusing on the real threat, Check Point has decided to throw an umbrella ban on Shodan, with no guarantee that threat actors won't stop scanning the Web with other similar search engines or their own scanners.

"If you stick your head into the sand, the problem has gone away". Such a simple solution does not exist, and a security company should know that. It says a lot about Check Point, which should probably rename itself to Checkmate because with that press release it managed to move itself into a position where everybody points at them and laughs.

Netflix’s fight against VPNs begins, but it’s doomed to fail. And Netflix knows it.

Found on Venture Beat on Friday, 22 January 2016
Browse Internet

Netflix promised it would begin targeting those who use proxies and VPNs to watch geo-restricted content, and now it seems the company is acting on that promise.

Netflix is now available more or less globally, in almost 200 countries, but the fragmented nature of global licensing means that TV shows and movies on Netflix vary from region to region.

Keep in mind that they block those who actually want to pay, and remember that next time you hear the studios whining about piracy.

Netflix cracks down on proxy streaming

Found on BBC News on Friday, 15 January 2016
Browse Internet

Due to licensing agreements, Netflix content varies between countries - many users have a virtual private network (VPN) or other proxy to get round this.

But some countries have more content than others - for example, the Australian Netflix catalogue has only about 10% of the content available to its US subscribers.

Subscribers that currently use proxies to view content outside their countries will only be able to access the service in their own countries in the coming week, the company said.

All humans are equal. Unless you are an American who wants to watch some pointless TV shows.

Mozilla Re-enables SHA-1 Certificate Support in Firefox

Found on eWEEK on Thursday, 07 January 2016
Browse Internet

In an unexpected move, when browser vendor Mozilla released Firefox 43.0.4 on Jan. 6, it re-enabled support for newly issued SHA-1(Secure Hash Algorithm 1) security certificates. Mozilla had previously set Firefox to reject new SHA-1 signed Secure Sockets Layer/Transport Layer Security certificates as of Jan. 1.

"When their users can't access Websites, they simply switch browsers, so sticking with this policy does more harm than good to both Mozilla and their ability to raise the bar on security," he said. "I don't think Mozilla is giving up on their position, just being practical."

So basically, Mozilla trades security for market share.

Internet Freedom Is Actively Dissolving in America

Found on Vice on Saturday, 26 December 2015
Browse Internet

Broadband access is declining, data caps are becoming commonplace, surveillance is increasing, and encryption is under attack.

Opposition to citizen access to encryption has become so pervasive within the government that Hillary Clinton actively campaigned at Saturday’s debate for a “Manhattan-like project” to break encryption.

And so many, many Americans may soon be left with an insecure, surveilled, and capped internet connection dominated by broadband and cellular providers that funnel traffic to the companies they’ve made deals with.

The worst enemy is always in your own rows.

Is U.S. Critical Infrastructure Under Attack?

Found on eWEEK on Tuesday, 22 December 2015
Browse Internet

A pair of recent reports allege that foreign attackers have been able to infiltrate U.S. critical infrastructure. A Wall Street Journal report alleged that Iranian hackers were able to infiltrate the operation of a dam not far from New York City. An Associated Press report alleged even more widespread risks to the U.S. power grid, in particular an attack involving power producer Calpine.

The idea that industrial control systems aren't yet fully hardened for the modern world of cyber-attacks is shared by Lila Kee, chief product officer and vice president of business development at GlobalSign

The hyped IoT is hardly ready for the "modern world of cyber-attacks", so it is no surprise that old systems aren't either.

13 Million MacKeeper Users Exposed

Found on Krebs on Security on Tuesday, 15 December 2015
Browse Internet

The makers of MacKeeper — a much-maligned software utility many consider to be little more than scareware that targets Mac users — have acknowledged a breach that exposed the usernames, passwords and other information on more than 13 million customers and, er…users.

Vickery said he reached out the company, which responded quickly by shuttering public access to its user database, and publicly thanking him for reporting it.

Vickery said he was able to connect to the database that Shodan turned up for him just by cutting and pasting the information into a commercial tool built to browse Mongo databases.

Obviously they don't run a firewall, otherwise MongoDB's port would have not been accessible from outside. By default, any service should listen on localhost only so it requires extra steps to open it up to the Internet; not to mention that this includes configuring the firewall too.

Gmail Now Offers Alerts if Sensitive Data Is Being Sent

Found on eWEEK on Friday, 11 December 2015
Browse Internet

Gmail DLP works by allowing organizations to set policies that flag messages which include sensitive information such as Social Security or credit card numbers, wrote Frey. Such a policy might say that sales department workers should not share customer credit card information with vendors, for example.

"These checks don't just apply to email text, but also to content inside common attachment types―such as documents, presentations, and spreadsheets," Frey wrote. "And admins can also create custom rules with keywords and regular expressions."

Another question is if you want to use the big data collector for your business email at all.

Kazakhstan Decides To Break The Internet, Wage All Out War On Encryption

Found on Techdirt on Wednesday, 09 December 2015
Browse Internet

A new law takes effect in the new year that will require all citizens of the country to install a national, government-mandated security certificate allowing the interception of all encrypted citizen communications. In short, the country has decided that it would be a downright nifty idea to break HTTPS and SSL, essentially launching a "man in the middle" attack on every resident of the country.

Last month, Human Rights Watch described Kazakhstan as an authoritarian dictatorship with "few tangible and meaningful human rights." Freedom House, meanwhile, ranks Kazakhstan poorly when it comes to Internet freedom.

Sounds bad? The UK and US are basically asking for the same when they demand backdoor access to all encryption.